Cybersecurity Awareness Month: Why People Still Matter in the Age of AI
Published October 18, 2026
Every October, Cybersecurity Awareness Month reminds organizations to revisit how prepared their employees are when it comes to recognizing today’s threats.
Most organizations have delivered awareness training before. And, most employees know not to click suspicious links. Yet year after year, attackers continue to succeed by exploiting one of the most reliable vulnerabilities available to them: human trust.
That reality stood out clearly in Ontinue’s newly released 1H 2026 Threat Intelligence Report. While attackers are embracing AI, automating parts of their operations, and finding new ways to scale their campaigns, many of the attacks we investigated still began with a simple interaction.
A user clicked a link.
Someone approved a prompt.
An employee trusted a phone call that seemed legitimate.
A finance team member acted on a request that appeared to come from a trusted partner.
The tools have changed, but the psychology has not.
Today’s attackers understand that breaching a firewall is often harder than convincing someone to help them. Rather than breaking into organizations, they increasingly log in using stolen credentials, hijacked sessions, fraudulent app permissions, and social engineering. The threat report highlights the continued rise of identity-focused attacks, demonstrating that access has become one of the most valuable commodities in cybercrime.
What makes this challenge more difficult is that artificial intelligence is helping attackers become more convincing. Phishing messages no longer need to contain obvious spelling errors or awkward phrasing. And, deepfake technology allows criminals to impersonate executives, colleagues, and trusted contacts with alarming accuracy. Messages that once would have appeared suspicious can now look completely legitimate.
As a result, security awareness needs to evolve as well.
Employees don’t need to become security analysts. They don’t need to memorize every cyber threat or understand the technical details behind malware. What they do need is a healthy sense of skepticism and the confidence to slow down when something feels unusual.
That could be an email asking them to urgently review a document. It could be a Teams message from someone claiming to be IT support. It could be a phone call from a leader requesting an immediate payment or asking them to bypass an established process. Increasingly, it could even be a QR code, a rogue application request, or even a perfectly convincing voice on the other end of the phone.
Many of the threats we highlighted in this year’s Cybersecurity Awareness Month materials share the same underlying characteristic. They rely on creating a sense of urgency.
Attackers want people to act before they think. They want employees to feel pressure. They want them to believe that something is broken, overdue, confidential, or time sensitive. Whether the lure is a phishing email, a fake MFA request, a QR code, a deepfake voice call, or a fraudulent invoice, the goal is often the same: to make normal verification processes feel like an inconvenience.
Awareness is no longer just about protecting employees from phishing emails. It’s about helping people navigate an increasingly complex environment where attacks can arrive through email, chat, text message, social media, phone calls, collaboration platforms, and AI-powered impersonation schemes.
The good news is that effective security behavior remains surprisingly simple.
The most successful employees aren’t the ones who can identify every threat. They’re the ones who are willing to pause. They verify unexpected requests through a second channel. They question urgency. They ask for confirmation. And when something doesn’t look right, they report it.
Those actions may seem small, but they often make the difference between an isolated security event and a major business incident.
During Cybersecurity Awareness Month, this is a valuable opportunity for organizations to remind employees that cybersecurity is not solely the responsibility of the security team.
Every employee plays a role. Every interaction matters. Every report helps.
Technology will continue to improve. AI will continue to transform both defense and attack. But one truth remains remarkably consistent: security is ultimately a human challenge.
That’s why awareness still matters. And in an era of AI-generated scams, deepfake impersonation, and increasingly sophisticated social engineering, it may matter more than ever.
Our Chief Security Officer, Craig Jones, created a resource you can use to help strengthen the cyber awareness of your employees. (It’s offered both as a PDF version, which you can use as is, and a PPTX version, which you can adapt to your organization’s needs.)
Drawing on real-world threats and lessons observed by Ontinue’s Cyber Defense Center, this practical awareness presentation covers some of the most common cyber threats employees are likely to encounter today, from phishing and fake IT support scams to deepfakes, QR code attacks, and AI-related risks.
Whether you use it during Cybersecurity Awareness Month, or generally throughout the year, we hope you find this resource useful and encourage you to adapt it for your organization and awareness initiative.
