Don’t make it easy: Cyber defense beyond employee vigilance
Capgemini ·
October 2026 is Cybersecurity Awareness Month. And while the theme, “Don’t make it easy for them,” may sound like a modest response given how frontier AI models can turbocharge the speed and volume of cyberattacks, there is good news too. As technologists, we need to balance our enthusiasm towards new AI capabilities with temperance. The post Don’t make it easy: Cyber defense beyond employee vigilance appeared first on Capgemini .
October is Cybersecurity Awareness Month.
And while the 2026 theme, “Don’t make it easy for them,” may sound like a modest response given how frontier AI models can turbocharge the speed and volume of cyberattacks, there is good news too. As technologists, we need to balance our enthusiasm towards new AI capabilities with temperance.
The same models that cause great concerns are also deployed in our defense. Moreover, AI alone can’t prevent cyberattacks. Only a holistic approach to cybersecurity with humans in the loop, directly working with agents can. We need to stop thinking just in terms of a secure perimeter for the organization and start thinking in terms of a supercharged defense system.
Cybercrime used to take more human time and effort. Traditionally, a threat actor would probe an organization’s systems looking for weaknesses and then, having found one, manually craft and deploy their payload – this would take weeks or months. But with cyber-AI models in the market (i.e., OpenAI’s ChatGPT 5.6 Cyber or Anthropic Claude Mythos 5.1)automating discovery of vulnerabilities and generative models writing malicious code to exploit the vulnerabilities at machine speed, hostile actors can relentlessly and persistently attack multiple points at once. And working alone, human teams struggle to keep up.
Appropriately applied, AI can reduce the time and effort spent on manual investigation and routine work, expanding the capacity of existing teams. According to a Microsoft-commissioned Forrester Consulting study, one global professional services firm reported saving 8–10 hours of manual ticket work per identity engineer each week using Microsoft Security Copilot.
Going beyond security operations, cyber leaders can continue to encourage employees to be vigilant, avoid clicking suspicious links and practice password hygiene, but employee awareness can only be the foundation for something bigger. With hostile bots taking aim at many targets simultaneously, organizations need to tighten access permissions, patch vulnerabilities, correct configuration weaknesses and impose strict governance over AI deployments – and leadership must ensure that each safeguard has a clear owner, sufficient resources, and oversight.
When early-warning systems generate constant alerts, the alarm just becomes noise that leaves teams on hyperalert with no clear picture of which threats constitute the most severe risks.
Cybersecurity needs to establish which vulnerabilities in the system attackers could realistically exploit, and what data or systems these would allow them to access. AI-enabled cybercriminals hunt down vulnerabilities that in isolation seem low-stakes but, due to the hyperconnected nature of modern organizations, may in fact constitute the first steps down a path that ultimately leads to sensitive data or essential systems.
Prioritize patching vulnerabilities that could affect critical operations, sensitive information, or essential services. Deploy AI to map potential attack paths before the attackers do and identify priorities, then apply human judgement to assess the business consequences.
US consumers surveyed by Forrester are sending a clear message that they take data security very seriously: 30% said that they would stop doing business permanently with a company that lost their data.
Combine prevention, attack detection, recovery, and business continuity, with AI accelerating investigation and routine response tasks while the humans in the loop oversee the decisions that matter. The ability to act quickly – disabling compromised credentials, revoking access, and isolating affected areas to determine what data or systems, if any, have been compromised – can limit organizational disruption. The firm cited in the Forrester study reported a 60–70% reduction in mean time to respond using Microsoft Security Copilot.
With AI, organizations can implement a three-point system that provides:
Assign ownership for cyber resilience and establish who will be accountable for AI systems before they’re put to operational use. A successful cybersecurity strategy must establish these first principles:
AI is overhauling the economics of cyber defense, increasing the amount of defensive work an organization can do with the people and budget available, and buying precious time for defense teams already stretched by the sheer volume of threats.
Meanwhile, cybersecurity teams are in a race against adversaries; and the asymmetry between them will ebb and flow. AI companies are systematically giving access to frontier AI models via OpenAI Daybreak and Anthropics’s Glasswing programs and minimizing the access of such models to potential bad actors. The business impacts of a cyberattack largely depend on how organizations allocate security resources, how quickly teams act, and how effectively they can manage risk. The responsibility to “not make it easy” for hostile actors now goes beyond employee vigilance: security must be an enterprise effort as well as an individual one, cracking down on loose permissions and unmanaged third-party access.
Strengthen organizational defense systems with AI protection that can identify an intrusion, limit the damage, and aid recovery. Decide the metrics by which you’ll judge its success: consider continuity of critical operations, speed, and effectiveness of threat containment, quantity of sensitive data protected, and whether the organization is able to recover within agreed timeframes.
Humans will make mistakes, but with the right resilience measures in place, we can make it difficult for hostile actors to exploit those mistakes and reduce the risk of them becoming business crises.
The post Don’t make it easy: Cyber defense beyond employee vigilance appeared first on Capgemini .