- Most UK workers receive no training on AI-driven cyber threats despite growing risks
- Younger employees now report lower confidence spotting AI scams than older workers
Despite AI-powered cyber-threats making headlines every day, most workers have not received any sort of training or education on how to spot these attacks, or how to behave in case they’re a victim of one, new research has claimed.
QA conducted a TLF survey of 1,000 people and found that, in the last 12 months, almost two-thirds of workers (61%) admitted to receiving “no training whatsoever” on AI-driven cyber-threats. For the researchers, these findings revealed a “significant gap in how prepared businesses are against AI-driven threats, and how confident staff feel in spotting these convincing fakes.”
Artificial Intelligence has grown from a humorous gimmick into a powerful tool that threat actors can use to draft convincing phishing emails, rendering one of the best methods of defence - proofreading - largely useless.
But they did not stop there. AI is now being used to create deepfake videos and audio, tricking people on video calls and through audio messages. Just recently it was reported that Paolo Molesini, former chairman of Fideuram - Intesa Sanpaolo Private Banking (a very large Italian private-banking and wealth-management group, owned by Intesa Sanpaolo), fell victim to a highly convincing AI-powered phishing attack and ended up wiring more than $100 million overseas.
No policies
At the same time, QA found almost a quarter (22%) said their organization had no policies in place to combat phishing emails, deepfake voice scams, or AI-generated fake invoices.
In the pre-AI era, the younger generation was the one most confident in their ability to spot and prevent a cyberattack. Millennials, Gen Z’s, and younger, were born into the computing age and grew tech-savvy from their earliest days, giving them a unique ability to spot scams. As a result, the elderly were among the most targeted group, and one with highest recorded losses.
Today, the tables have turned. Knowing how dangerous AI is, and how difficult it is to spot, 18-24-year-olds are now the least confident in getting caught out, as almost two in five (39%) admitted their worries.
Age differences aside, QA identified other confidence gaps, as well. It says that less than one in ten (9%) of non-management workers confirmed they were “very confident” in being able to spot an AI-generated phishing email, compared to 48% of owners/partners, and 33% of board directors.
Among workers that received any form of training, just a quarter (25%) described it as being dedicated to AI-driven threats. A third (30%) said AI threats were only covered as part of generic cybersecurity training, meaning almost three-quarters (70%) either received no training at all, or have only had AI threats covered through other forms of training.
Building the foundations
“It’s clear from the survey data that organizations need to build the foundations on basic AI literacy, so that business leaders and workers feel confident in spotting these threats,” commented Dr Vicky Crockett, Portfolio Director for AI at QA.
“When it comes to training, it’s imperative that all job roles can positively spot any AI-driven cyber threats, but when it comes to AI training, there’s no one size fits all, so combining baseline AI literacy learning with job specific training is usually the best fit.”
Interestingly enough, QA did not discuss if workers were using AI themselves to help them spot AI-powered attacks. Cybersecurity professionals have been deploying frontier models for years, taking advantage of machine learning and speed to tackle advanced threats.
"The findings suggest organizations are facing a skills challenge as much as a cybersecurity challenge,” said Jo Bishenden, Chief Learning Officer at QA. “AI is changing the way people work, but many employees are not building the skills they need to understand the risks and opportunities that come with these new technologies.”
