The theme for Cyber Security Month this year is: Take a second. Stay secure.
Throughout October we have highlighted risks associated with Artificial Intelligence (AI), including privacy concerns. We also shared some tips on how AI can benefit your business when it is used strategically and backed by adequate controls. What can be all too easily overlooked in this conversation however is the critical role of the human being, as technical countermeasures alone are rarely enough to address security issues.
There is a human element in most breaches. Given the right tools and techniques, humans tend to be susceptible to psychological manipulation; and unfortunately, Magneto's helmet is not readily available to shield us from social engineering. Verizon’s 2026 Data Breach Investigations Report found the human element was present in 62% of breaches, and 41% of social engineering attacks now involve vectors beyond email. IBM’s 2026 Cost of a Data Breach report mirrors this trend, showing that phishing remains one of the top initial attack vectors used in breaches. After all, people are prone to mistakes.
Which begs the question: with AI acting as a force multiplier for attackers, how do we teach people to spot these improved, and less conventional, social engineering attacks?
In April 2025, Australians woke up to the news that cyber criminals had begun launching attacks against several major Australian superannuation funds. Attackers used credential stuffing, trying usernames and passwords stolen in earlier breaches, to gain access to funded accounts. Credential stuffing worked in this case because people tend to reuse the same password across multiple accounts, and because of weaknesses in how the accounts were protected.
In June 2025, a major Australian Airline confirmed it had encountered a cyber incident affecting customer data. How did it happen? A threat actor known as Scattered Spider had phoned an agent at an overseas contact centre run by a third-party provider. The caller posed as IT support, coached the authorised agent and connected through their authenticated session, to gain access to a customer database, ultimately resulting in the unauthorised disclosure of approximately 5.7 million customer records.
This trend has been turbo-charged by AI, with the rise of deepfake technology being used in social engineering attacks. In 2024, a Hong Kong-based finance worker got tricked into paying out over US$25 million to fraudsters after a video call. The worker had initially been suspicious but was reassured because they thought they knew everyone on the call. Further, for most staff, being on a video conferencing call with senior executives and having to ask them to prove their identities before continuing the conversation is a daunting prospect to say the least.
It’s easy to see why the use of deepfakes in social engineering is only likely to rise. Despite an extensive and ongoing investigation by the Hong Kong Police, the funds remain unrecovered, and no arrests have been publicly announced.
Technical controls often fail because humans can be readily deceived; however, studies also show that simple phishing simulations are of limited effectiveness. One thing is clear: while basic training raises awareness about the tactics and tricks that attackers employ, on its own it fails to educate people on *why* they should remain perpetually vigilant, or account for human fatigue.
Treating security as solely a technology problem overlooks the human beings who are sharing data with third parties, developing tools, negotiating critical SLAs with key vendors, or on the keyboard of every system. By providing context-specific, targeted awareness and education, paired with technical controls, a comprehensive security culture can be nurtured to ensure long-term resilience.
The goal is to turn awareness into simple actions: confidence in how to securely share sensitive data; knowledge of the latest trends and threats; proactive reporting of suspicious system behaviour; or project teams reaching out for advice during planning, not after go-live.
Security should enable work, not add friction and restrictions that push people towards shadow IT. By applying simple, effective measures, we can individually and collectively keep improving our cyber resilience.
What does this mean for you? Taking a second is the simplest defence we have – but often the most effective.
Recognise the signs – Attackers prey on heightened emotions and fatigue to short cut our reasoning: urgency, fear, authority, curiosity and the wish to be helpful are all exploitable human traits. If it doesn’t feel right, verify through a channel you already trust, such as calling back on a number you know before you click, pay or share.
Look after the people, not just the systems – Mental health plays a huge role in awareness and susceptibility. Tired, stressed and overloaded people make faster, riskier decisions. This is why many phishing attacks are launched at the start or end of the day.
Get the basics right – Organisations should make good security the path of least resistance, by making passkeys, password managers and multi-factor authentication accessible by default, rather than relying on the good sense of the user.
No shame, no blame – Make "report it" the easiest option, with one click or one call, and celebrate people when they use it. If cyber security is only ever known as the fun police, it’s difficult to build good rapport with your user base.
Make training dynamic – Annual modules and generic phishing tests are not enough on their own. Keep training short, relevant to each role, and current with real attacks, including phone calls, text messages, and deepfake videos. Most of all, make it fun and engaging – when you are fighting the good fight every day, it can be all too easy to forget what made you fall in love with cyber security in the first place!
