Dan McCalla - Copywriter
Freelance writer in the UK, covering B2B marketing copy, editorial and just about anything else...
Blue and Black Modern Cyber Security Presentation.jpg

Security Scribblings

AI Security: How Aware Are Your Employees?

OK - so your employees have found next-level productivity through AI.

But are they introducing security risks in the process?

Businesses, let alone individual employees, have been relatively slow to respond to the growth of AI from a security perspective. IBM’s 2025 Cost Of A Data Breach report found that 97% of organisations that had suffered a breach connected to AI didn’t have proper AI access controls in place at the time.

The good news is that businesses are responding: according to Mimecast’s State Of Human Risk 2025, 80% of businesses say they are concerned about sensitive data being leaked through the use of generative AI tools.

But that doesn’t necessarily change the fact that human error remains a big vector for security breaches. And AI magnifies that risk, because vulnerabilities can be introduced by the simplest and most innocuous of activities, with employees not even aware that they’re doing anything wrong.

Typical examples include (are in no means limited to):

  • Data misuse: copying and pasting sensitive information from other platforms into data prompts, without knowing how that data may be retained and used later on, or by whom

  • Limited checks: the lack of a human verifying AI output could lead to hallucinations or misinformation being communicated by employees, or released into the public domain as ‘fact’

  • Unnecessary authorisation: too many people being able to use certain datasets and/or certain AI tools, leading to unauthorised processes and workflows that aren’t strictly necessary for the business

Of course, the likelihood is that a significant proportion of employees are taking adequate precautions, but there will always be some who are prone to errors or introducing risks. Mimecast’s report found that, across all types of security incidents, 80% of them are caused by just 8% of users.

But these are the employees where it can be hard to get the message through about cybersecurity - and where stronger controls are a must. What should those controls look like in practice, though?

  • Acceptable use policies?

  • Mandating humans in the loop?

  • Formalising expectations around AI use in HR and employment documents, including contracts?

So what do you think is the best way forward for promoting good AI security workforce-wide? Get in touch on LinkedIn and let me know your thoughts.

Dan McCalla