A majority of security leaders surveyed believe that management does not fully understand the cyber risks associated with employees. At the same time, AI makes social engineering attacks more credible, scalable and difficult to detect.
78 percent of CISOs who participated in a recent survey believe that senior decision-makers do not fully understand the cyber risk associated with employees.
The survey was commissioned by the cybersecurity company MetaCompliance and conducted by Censuswide. It includes 200 CISOs at companies with at least 250 employees in Sweden, Great Britain, France and Germany, with 50 participants from each country. 
The results indicate that MetaCompliance on a gap between the risks that organizations face and the support, responsibility and shared understanding required to manage them.
AI is amplifying attacks on employees
AI is changing the landscape of social manipulation. Attackers can use the technology to create more convincing phishing attempts, impersonations, and fraudulent messages on a large scale.
The focus of attacks is thus shifting more towards employee judgment and actions, rather than solely towards technical vulnerabilities.
Among participants who feel less confident about their organization's resilience to cyberattacks than twelve months ago, almost half cite more advanced AI-based attacks through social engineering as the primary reason.
More than four in ten participants also worry that AI will increase both the speed and consequences of these types of attacks.
Employees are identified as the biggest risk
68 percent of CISOs surveyed identify employees as the organization's biggest security risk.
According to MetaCompliance, the results show how AI can amplify risks that already exist at the human level. For example, employees can be tricked into giving out information, approving a payment, or opening malicious files.
The study also identifies risks associated with how AI is used within organizations:
- 40 percent worry about employees sharing sensitive information with generative AI services.
- 41 percent fear that malicious individuals within the organization will use AI for fraud, cybercrime or information theft.
- Almost a quarter see strengthening resilience against AI-based social manipulation as a key focus area in the next twelve months.
Concerns about deepfake attacks were particularly high in the UK, with more than half of UK respondents identifying such attacks as a significant threat to their organisation, the highest level among the markets surveyed.
Management support wanes over time
At the same time, 79 percent of participants state that management support for security awareness initiatives tends to decrease over time.
76 percent also experience difficulties in meeting various stakeholders' demands on how to measure human cyber risk. Almost a quarter describe coordination between the different functions of the business as one of the areas where they feel least secure.
The results suggest that many security managers are expected to manage risks without clear shared responsibility or long-term commitment from company management.
James Mackay, CEO of MetaCompliance, believes that human cyber risk can no longer be considered solely as a matter of education and security awareness.
According to Mackay, the area needs to be managed as a strategic business risk instead, with clearer ownership, better coordination between different stakeholders and long-term support from management.
From recurring training to ongoing risk management
As AI-generated content becomes more difficult to distinguish from legitimate communication, MetaCompliance says, one-off or recurring training sessions will not be enough.
Instead, organizations need to continuously work on the risks linked to employee behavior. MetaCompliance points to behavioral analysis, context-based guidance, and targeted interventions when risk situations actually arise.
The aim is to help employees make better security decisions in a situation where AI-based attacks are becoming more convincing and harder to detect.
About the survey
The survey was conducted by Census-wide on behalf of MetaCompliance. A total of 200 CISOs over 30 years of age participated at companies with more than 250 employees.
The participants were evenly distributed between Sweden, Great Britain, France and Germany. Data collection was conducted between February 17 and 23, 2026.
Censuswide is a member of the Market Research Society and the British Polling Council and has signed the Global Data Quality Pledge.
Source: MetaCompliance – 78% of CISOs say C-level do not fully understand employee-driven cyber risk
Swedish 
Danish 
Norwegian 
Finnish 
English 
German 
Dutch 