Consider an illustrative scenario: a company runs a phishing simulation, and a small minority of employees click the link. Six months later, after adding a GenAI chatbot to its internal tools, it runs another simulation targeting AI-related risks — paste proprietary code into a public LLM, click a link to a fake AI training tool, approve an AI-generated email to the CEO. Several times as many employees take the bait.
Key Takeaway
Change the conditions that make unsafe AI use the easy path, instead of only telling people what not to do.
I've watched traditional security awareness training fail for AI risks. The phishing simulation doesn't prepare anyone for a prompt injection attack in their coding assistant.
The disconnect is clear: employees who learned to avoid suspicious email links haven't learned to avoid suspicious AI tools. GenAI has introduced a new category of social engineering that traditional security awareness training doesn't cover, and it makes older tricks like executive impersonation more convincing (see deepfake defense).
What is a security behavior culture program (SBCP)?
An SBCP is a sustained effort to change how employees think about and behave around security — not through annual compliance training, but through continuous engagement, contextual guidance, and leadership modeling.
Gartner's top cybersecurity trends for 2026 put it bluntly: GenAI breaks traditional cybersecurity awareness tactics. In a Gartner survey, over 57% of employees said they use personal GenAI accounts for work and 33% admitted entering sensitive information into unapproved tools. Gartner recommends shifting from general awareness training to adaptive behavioral programs that include AI-specific tasks. Technical controls catch the attacks they're designed for. They don't catch the ones where a well-meaning employee pastes customer data into a public LLM because the tool said it would help.
Why does GenAI require a different approach?
Because GenAI attacks exploit trust and convenience, not fear. A phishing email triggers suspicion — weird formatting, unexpected sender, urgent language. A GenAI tool triggers enthusiasm: it's new, it's powerful, it's what the company says it wants employees to adopt.
The threat model is inverted. Employees aren't the weak link in GenAI adoption. They're the vector. They want to use AI tools, and they'll find ways to use them even when policy says not to: Verizon's 2025 DBIR found 15% of employees routinely accessing GenAI systems on corporate devices, and 72% of those using non-corporate emails as their account identifiers. The question is whether they'll use approved tools with proper data boundaries or unapproved tools with none.
What actually changes behavior?
Contextual training. Don't train employees on "AI security" in the abstract. Train them on the specific tools they use. When your company deploys a new AI coding assistant, run a 15-minute session on what data the tool can access, what it shouldn't be used for, and how to recognize when it's giving unsafe suggestions.
Leadership modeling. If the CTO uses an unvetted AI tool in an all-hands meeting, the signal is louder than any policy document. Leaders need to model the behavior they want to see: using approved tools, asking security questions before connecting new integrations, and publicly acknowledging when they made a mistake.
Safe alternatives. Employees will use AI tools regardless of policy. The organization's job is to provide safe alternatives that meet their actual needs. If developers need coding assistance, provide a tool that's trained on open-source code only, with PII redaction, and with clear data handling policies. If the approved tool is harder to use than the unapproved one, the unapproved one wins.
Behavior measurement. Track what people actually do, not what they say in surveys. Monitor for AI tool usage patterns: shadow AI connections, data exfiltration through AI services, prompt injection attempts. Use the data to identify where training and tooling are failing.
Security behavior culture program design
| Element | Traditional Training | SBCP for GenAI |
|---|---|---|
| Frequency | Annual | Continuous, triggered by events |
| Content | Generic security awareness | Contextual, tool-specific guidance |
| Delivery | Mandatory video, quiz | Micro-learning, in-app prompts, discussions |
| Measurement | Quiz scores, phishing click rates | Shadow AI adoption rates, safe tool usage, incident trends |
| Leadership role | Compliance checkbox | Visible modeling of secure AI behavior |
The shift is from "employees are the problem" to "the organization creates the conditions for secure behavior."
How do you measure success?
Track shadow AI adoption rates over time. If they're decreasing, the program is working. If they're flat or increasing, the approved alternatives aren't good enough or the training isn't landing.
Also track incident trends: how many AI-related security incidents per quarter? How many involved approved tools vs. unapproved tools? The ratio tells you whether the problem is tooling or behavior.
In the security culture programs I've reviewed, contextual, scenario-based training consistently did more for AI-risk awareness than generic e-learning modules.
FAQ
What's the difference between security awareness training and an SBCP?
Awareness training teaches employees what not to do. An SBCP changes the organizational conditions that make insecure behavior the path of least resistance.
How long does it take to change security behavior?
Expect months of sustained effort, not a single campaign. Annual training doesn't change behavior. Continuous engagement does.
Should I punish employees for using shadow AI?
Punishment drives adoption underground. The better approach is to make the safe path easy, provide approved alternatives, and focus on changing the system, not blaming individuals.
What's the biggest SBCP mistake?
Treating it as an IT problem. Culture change requires leadership involvement, not just security team initiatives.
How do I get leadership buy-in?
Show them the data. Shadow AI incidents cost money: IBM's 2025 Cost of a Data Breach Report found that a high level of shadow AI added an extra $670,000 to the global average breach cost. Frame the program as risk reduction, not compliance.