The theme of this year’s Cybersecurity Awareness Month is ‘don’t make it easy for them.’ It might fall short of being a revelatory concept, but it has taken on new significance as AI has taken centre stage.
Tasks that were once ‘easy’ for threat actors now look different as they weaponise AI. For businesses and their security teams, the bar for making an attack difficult has risen.
So how do businesses make life harder for those looking to enter their systems, steal sensitive information and cause disruption? The advice differs, but one common thread emerges: people, processes and technology are most effective when they reinforce one another.
Attackers benefit from gaps between people, teams and systems. Making life harder and closing those gaps is a good place to start this Cybersecurity Awareness Month.
Know the rules before you start playing
Security policies establish the rules businesses expect employees and systems to follow. But as AI becomes more widely adopted, enforcing those rules is becoming complicated.
Spencer Young, SVP International at Delinea argues the challenge lies in how these policies are enforced. “It’s not that businesses don’t have AI policies in place. In fact, recent research found that 99.7% of IT and security leaders say their organisation has a formal AI data-access policy. The problem is enforcement.”
Enforcing policy is tricky when businesses are stuck between rushing to embed AI to stay competitive and taking a more cautious approach to deployment.
“Far too often, businesses are solving the tension between AI speed and security by legitimising risky access,” Young adds. “Just over half check AI access against policy in real time, fewer than one in five can detect a scope violation as it happens and 87% say an AI tool has exceeded its intended scope in the last year. Unfortunately, that risks doing exactly what Cybersecurity Awareness Month warns against: making it easy for cybercriminals.”
Robust AI governance is clearly essential. However, overly restrictive policies can create problems of their own, particularly when employees face lengthy approval processes for tools to help them work more effectively.
For Jacopo Santaiti, Cyber Security Manager at Soldo, “Employees need a straightforward route to approved tools. Businesses should set spending limits and permissions in advance, require human approval for higher-risk purchases and link expenses to traceable payments. That gives teams the flexibility to use AI while helping finance and security spot problems before they grow.”
Even the best policy will fail if employees don’t understand why it exists or feel equipped to follow it. Security therefore needs to become part of everyday work, rather than something revisited during an annual training exercise.
Know the rules before you start playing
Matthew Lloyd Davies, Principal Security Architect at Pluralsight, argues that organisations need to go beyond reminding employees not to click suspicious links.
He says, “A strong security culture means giving people the skills to recognise where everyday processes and behaviours could create an opening for attackers.” Lloyd Davies also emphasises the importance of shared responsibility, “Developers, IT teams, administrators and non-technical employees all have a role to play.”
That requires continuous learning rather than one-off training. Scenario-based exercises and simulations can help employees understand how to respond under pressure while giving security teams an opportunity to identify weaknesses before attackers find them. The aim, Lloyd Davies adds, is to build a workforce that is “security-minded and prepared to question how things could go wrong.”
The same collaborative principle applies beyond the boundaries of an individual business. Increasingly complex supply chains give attackers opportunities when companies fail to share information.
Haydn Brooks, CEO and co-founder of Risk Ledger, says the focus on AI should not distract businesses from the human qualities needed to secure those relationships.
He says, “Given how interconnected and complex modern supply chains have become, attackers maintain the upper hand when businesses continue to work in silos and fail to collaborate on what is ultimately a shared threat.”
Brooks concludes, “Collaboration, communication and empathy are all intrinsically human qualities and they all have a practical role here. Businesses sharing suppliers need to be aware of and address common risks together and their security teams need relationships that allow them to flag concerns early and coordinate responses across supply chains.”
See the whole attack surface
Of course, people can only respond to the risks they can see. As AI becomes embedded across more applications, networks and devices, maintaining that visibility is becoming harder.
Evidence of the gap is already emerging. Frank Cotto, Field CTO, Infrastructure Management and Operations at Progress Software, points to government researchshowing that almost a third of UK businesses using, adopting or considering AI have no plans to introduce security practices to manage the associated risks.
“Businesses need visibility across networks, applications and devices so teams can identify unusual activity and respond quickly when something goes wrong,” Cotto says. “But visibility alone is not enough. Security and operations teams need to work more closely together, sharing intelligence and context across the same infrastructure rather than operating in isolation.”
As AI becomes more distributed, Cotto argues, this joined-up approach will be critical to maintaining control. Building resilience into infrastructure from the outset is far easier than trying to regain that control after new tools and services have spread throughout the organisation.
Turn awareness into action
In an era where agentic AI is doing much of the leg work, awareness is no longer enough. Gavin Millard, Vice President of Intelligence at Tenable, suggests that organisations need a shift in focus.
“Resilience is the harder, but more relevant question. When something is exposed, how quickly do you know? How fast can you work out what’s actually reachable? How can you fix it at machine speed? Not whether it happens, because it will, it’s the impact and the response that matter when it does.”
Identifying the most vulnerable assets and fixing them fast is key to this approach. He adds, “Know what an attacker, or an agent, could reach. Fix that first. Then practice the bit behind the headlines that has driven the awareness – resilience and response.”
Taken together, the advice points to a combination of human awareness and practical security controls. Richard Woolfrey, VP UK and Ireland at Fortinet, says this is particularly important as AI and automation allow cybercriminals to operate faster and at greater scale. Fortinet’s 2026 Global Threat Landscape Report found a 25% year-on-year rise in global exploitation attempts found a 25% year-on-year rise in global exploitation attempts.
“We need to make it harder for attacks to succeed,” Woolfrey says. “That starts with strengthening identity protection through measures such as multi-factor authentication, addressing vulnerabilities quickly and maintaining strong security controls.
“This also needs to extend beyond the tech stack and encompass a wider cultural shift across the organisation. Leaders must communicate that cybersecurity is a shared responsibility and ensure employees have the training and support they need to act as a first line of defence.”
There may be no way to make an organisation completely impenetrable. But clear rules, prepared employees, strong technical controls, better visibility and closer cooperation all leave attackers with fewer easy routes in. This Cybersecurity Awareness Month, that feels like a sensible place to start.
