Human Error, Not Hackers, Is the Biggest Cybersecurity Risk in the AI Era, Experts Warn

As artificial intelligence becomes a routine part of enterprise operations, security experts are warning that the biggest cybersecurity risks may come not from sophisticated hackers but from the everyday decisions of ordinary employees. For organisations in Pakistan and across the Middle East and Africa, building digital resilience now requires a coordinated strategy that brings together people, infrastructure, continuous monitoring and expert support, rather than relying on security software alone.

The arrival of generative AI tools has widened the corporate attack surface. Staff can now use AI assistants to draft reports, analyse customer information and automate routine tasks, often without fully understanding where sensitive data is sent or how long it may be retained. At the same time, cybercriminals are using AI to craft more convincing phishing messages, impersonate senior executives and speed up social engineering campaigns.

The challenge for technology leaders is to keep security controls in step with the tools employees actually use, while still meeting operational targets and controlling costs. Employees are often called the weakest link, but the picture is more complicated than simple negligence. People work under time pressure, juggle multiple applications and make decisions with incomplete information. When security procedures are confusing or detached from daily workflows, even experienced professionals can unintentionally expose an organisation to risk.

Recent reporting in Pakistan highlights the gap between written policies and real workplace behaviour. A 2026 report by Business Recorder, citing a Kaspersky survey, found that 8 percent of professionals said their organisations had no cybersecurity rules or that they were unaware of them, while 39 percent considered workplace security rules excessive or not entirely appropriate. The findings suggest that simply issuing policies is not enough; organisations must make security practical and relevant to the people expected to follow it.

Awareness efforts therefore need to go beyond an annual presentation. Businesses should offer regular training, realistic phishing simulations and clear guidance on approved AI tools, sensitive-data handling and identity verification. Employees also need a straightforward way to report suspicious activity without fear of disproportionate consequences. Technology remains essential, but it cannot make up for unclear procedures or a culture that treats security as somebody else's responsibility.

AI governance is fast becoming a practical business requirement. Organisations adopting generative AI must decide which tools employees may use, what information they may share and who is accountable for reviewing the risks of new deployments. Weaknesses can also emerge through excessive permissions, insecure integrations, unverified outputs and unauthorised access to corporate data, all of which can have wider consequences when AI systems are linked to internal documents and customer databases.

A sensible approach starts with visibility. IT teams need to know which AI applications are in use, where corporate information is stored and how access is granted. From there, they can set data classification rules, enforce least-privilege access, apply multifactor authentication and monitor unusual activity across users, devices and applications. AI systems also require ongoing oversight, including vendor assessments, permission reviews and clear procedures for responding to compromised accounts or inappropriate data exposure. Employees should know when human verification is mandatory, especially when AI-generated content feeds into financial decisions, customer communications or other sensitive business processes.