|
“Plans are of little importance, but planning is essential.”
― Winston Churchill |
Keeping Cyber Vigilance Alive When Employees Have So Much Else to Worry About  As winter settles in across New Zealand, many organisations are facing a perfect storm of challenges. Economic uncertainty continues to place pressure on budgets, ongoing geopolitical tensions in the Middle East are impacting global markets and operating costs, and organisations are simultaneously trying to understand both the opportunities and risks presented by Artificial Intelligence (AI).
At the same time, employees are feeling the strain. Rising living costs, concerns about job security, increasing workloads, and the shorter, darker days of winter can all contribute to fatigue, stress, and disengagement. Unfortunately, these same factors can also reduce cyber vigilance at a time when cybercriminals are becoming more sophisticated and leveraging AI to scale their attacks. The challenge for leaders is clear: How do we keep cybersecurity front of mind without creating yet another burden for already stretched employees? Understanding the Human Factor For many years, organisations approached cybersecurity awareness through compliance-driven training, annual courses, and periodic reminders. While these activities remain important, they often fail to account for a simple reality: People are not security systems. Employees are human beings balancing professional responsibilities, personal commitments, financial concerns, and their own wellbeing. When people become overwhelmed, their ability to identify suspicious emails, question unusual requests, or follow security procedures naturally declines. Cybercriminals understand this. Modern phishing campaigns are specifically designed to exploit distraction, urgency, and emotional responses. Increasingly, AI is helping attackers create highly convincing emails, voice messages, and fake communications that are far harder to identify than the scams of previous years. The question is no longer whether employees know what phishing is. The question is whether they can consistently apply that knowledge when under pressure. The Impact of Economic Pressure Periods of economic uncertainty often create conditions that increase cyber risk. Employees may be working longer hours, covering multiple roles, or managing higher workloads following cost-cutting measures. Leaders may be focused on financial sustainability and operational efficiency. In these environments, cybersecurity can unintentionally become viewed as an obstacle rather than an enabler. When productivity becomes the primary focus, employees may be more likely to:
None of these actions are typically malicious. They are often the result of good people trying to meet competing demands. This is why cybersecurity culture matters. Organisations that successfully maintain cyber vigilance focus on making secure behaviours easy, practical, and relevant to employees' daily work. AI: Both Friend and Foe Artificial Intelligence is changing the cybersecurity landscape on both sides of the battle. Attackers are using AI to create more convincing phishing emails, generate realistic fake websites, automate reconnaissance, and even clone voices. What once required significant technical expertise can now be achieved with widely available tools. However, AI also provides organisations with powerful defensive capabilities, including:
The danger lies in assuming that technology alone will solve the problem. No matter how advanced defensive systems become, employees remain the final decision-makers when approving payments, sharing information, or granting access. Human judgement continues to be one of the most critical layers of defence. Organisations should therefore position AI as a tool that supports employees rather than replaces their role in security. Winter Blues and Cybersecurity Winter can have a surprisingly significant impact on cyber resilience. Research consistently shows that seasonal changes can affect mood, energy levels, concentration, and motivation. Employees may experience increased fatigue, reduced engagement, and greater levels of stress during colder months. These factors directly influence cybersecurity behaviours. A tired employee is more likely to click a malicious link. A distracted employee is more likely to overlook a warning sign. A disengaged employee is less likely to report suspicious activity. This does not mean organisations need to launch major security campaigns every winter. Instead, leaders should recognise that employee wellbeing and cybersecurity are closely connected. Supporting staff wellbeing is not separate from cyber resilience—it is part of cyber resilience. Five Practical Ways to Maintain Cyber Vigilance 1. Keep Security Messages Short and Relevant Employees are already overwhelmed with information. Rather than lengthy awareness campaigns, provide concise and practical guidance that relates directly to current threats and business activities. A two-minute reminder about AI-generated phishing attacks may have more impact than a thirty-minute presentation. 2. Focus on Culture Rather Than Compliance People engage more effectively when they understand why security matters. Help employees see how their actions protect customers, colleagues, and the organisation's future rather than simply meeting compliance requirements. Cybersecurity should feel like a shared responsibility, not an imposed obligation. 3. Celebrate Positive Behaviour Many organisations only discuss cybersecurity when something goes wrong. Instead, recognise employees who report suspicious emails, challenge unusual requests, or identify potential risks. Positive reinforcement encourages ongoing engagement far more effectively than fear-based messaging. 4. Connect Cybersecurity to Wellbeing Encourage employees to take breaks, manage workloads, and seek support when needed. An employee who feels supported is more likely to remain alert and engaged. Human performance and cyber resilience are closely linked. 5. Make Reporting Easy Employees should never feel embarrassed about reporting something suspicious. Create an environment where reporting a concern is viewed as a positive action, even if the threat turns out to be harmless. The faster employees report potential issues, the faster security teams can respond. Leadership Sets the Tone Ultimately, cyber vigilance is not a technology problem—it is a leadership challenge. Employees pay close attention to organisational priorities. If leaders consistently demonstrate that cybersecurity, wellbeing, and business resilience are interconnected, employees are more likely to adopt the same mindset. In today's environment, organisations are navigating economic pressures, geopolitical uncertainty, rapid technological change, and workforce wellbeing challenges simultaneously. Expecting employees to remain constantly vigilant without support is unrealistic. The organisations that succeed will be those that recognise a fundamental truth: Cybersecurity is not about creating a workforce that is constantly fearful of making mistakes. It is about building a culture where people feel informed, supported, and empowered to make good decisions, even when pressures are high. When organisations invest in both their people and their security culture, cyber vigilance becomes not another task on the to-do list, but a natural part of how the organisation operates every day.
0 Comments
Cyber Incident Management Plans (CIMP) A Cyber Incident Management Plan (CIMP) is no longer a “nice to have” document that sits in a drawer waiting for a major breach. In today’s environment — where ransomware groups evolve weekly, AI-enabled phishing is becoming more convincing, and supply chain attacks can impact thousands of organisations simultaneously — a cyber incident management plan must become a living operational capability.
The challenge for many organisations is not recognising the need for a plan. It is building one that is practical, relevant, maintainable, and achievable within the reality of stretched budgets, limited time, and already overloaded teams. The good news is that an effective cyber incident management plan does not need to be overly complex or expensive. What matters most is clarity, ownership, adaptability, and regular improvement. Why Traditional Incident Plans Fail Many incident response plans fail for three common reasons:
An effective modern CIMP must therefore be:
Start With Business Risk, Not Technology One of the biggest mistakes organisations make is designing incident plans purely around technology systems. Instead, start by asking:
This approach keeps the plan relevant and aligned to real business impact rather than theoretical cyber threats. Keep the Plan Practical and Simple The most effective incident plans are often surprisingly concise. A practical plan should clearly define: 1. Roles and Responsibilities Who does what during an incident? This should include:
2. Incident Severity Levels Not every incident requires a full-scale response. Define simple severity categories such as:
3. Escalation Pathways Teams should know:
4. Communication Templates One of the most overlooked areas in incident response is communication. Prepare templates in advance for:
5. External Dependencies Most organisations rely heavily on external providers:
Build a “Living” Plan Cyber threats evolve too quickly for static documentation. A modern CIMP should be treated like any operational process:
Testing Does Not Need to Be Expensive Many organisations avoid testing because they assume it requires costly consultants, large simulations, or significant downtime. In reality, meaningful testing can be lightweight and highly effective. Start With Tabletop Exercises A tabletop exercise is simply a structured discussion around a realistic scenario. For example: “A staff member clicks a phishing email and ransomware begins encrypting shared files. What happens next?” Walk through:
Test Decision-Making, Not Just Technology Many organisations focus purely on technical recovery testing. However, the biggest challenges during incidents are often:
Cyber resilience is ultimately an organisational capability, not solely a technical one. Keep Exercises Realistic Overly dramatic “Hollywood-style” scenarios can overwhelm teams and reduce engagement. Instead, focus on realistic scenarios relevant to the organisation:
Create Continuous Improvement Loops Every test, exercise, or incident should generate lessons learned. After each exercise, ask:
This continuous improvement mindset is what keeps a plan relevant over time. Human Factors Matter Most Technology alone will never solve incident response challenges. People make decisions under pressure, often with incomplete information and emotional stress. Fatigue, uncertainty, and communication breakdowns can significantly worsen incidents. That is why organisations should prioritise:
Focus on Progress, Not Perfection Many organisations delay building or testing a plan because they feel under-resourced or insufficiently mature. But cyber resilience is not about perfection. It is about:
The organisations that respond best to cyber incidents are rarely the ones with the largest budgets. They are usually the ones that prepared realistically, tested consistently, communicated clearly, and continuously adapted to change. In a rapidly evolving cyber landscape, the most valuable incident management plan is not the most sophisticated one. It is the one your organisation can actually use. AI and Small Business: Balancing Opportunity with Security Risk  Artificial Intelligence (AI) is no longer a technology reserved for large enterprises with massive budgets and dedicated innovation teams. Today, small businesses are increasingly adopting AI-powered tools to improve productivity, automate repetitive tasks, enhance customer service, strengthen marketing efforts, and gain operational efficiencies.
From AI chatbots and automated accounting systems to AI-generated content and workflow automation, the opportunities for small businesses are significant. However, alongside these opportunities comes an equally important conversation: security. While AI can deliver tremendous business value, implementing it without understanding the associated risks can expose businesses to cyber threats, compliance failures, reputational damage, and operational disruption. For small businesses, which often have limited cybersecurity resources, these risks can be particularly impactful. The key is not to avoid AI — it is to implement it responsibly. The Growing Security Challenges of AI AI systems rely heavily on data. The more data an AI tool can access, the more powerful and useful it becomes. Unfortunately, this also creates new security and privacy concerns. Many small businesses are unknowingly exposing sensitive information when employees use publicly available AI tools without governance or oversight. Confidential customer information, financial data, internal procedures, intellectual property, or strategic business plans may be entered into AI platforms without fully understanding how that data is stored, processed, or reused. Some of the most common AI-related security risks include: Data Leakage Employees may unintentionally upload confidential information into AI systems. Once sensitive data leaves the organization’s controlled environment, businesses may lose visibility and control over how it is handled. AI-Enhanced Cybercrime Cybercriminals are now using AI to improve phishing attacks, automate scams, generate convincing fake communications, and identify vulnerabilities faster than ever before. Small businesses are increasingly targeted because attackers assume they have weaker security controls. Compliance and Privacy Risks Businesses operating under privacy regulations must ensure AI usage aligns with legal obligations surrounding data protection, customer consent, and information handling. Failure to do so can result in financial penalties and reputational harm. Over-Reliance on AI AI can accelerate decision-making, but it is not infallible. Inaccurate outputs, hallucinations, bias, or poor recommendations can create operational and reputational risks if human oversight is removed from the process. Shadow AI One of the fastest-growing concerns is “Shadow AI” — where employees independently adopt AI tools without approval from IT or leadership. This creates significant visibility and governance challenges for organizations. Why Small Businesses Cannot Afford to Ignore AI Despite the risks, avoiding AI altogether is not a sustainable strategy. Businesses that fail to adopt AI may struggle to remain competitive as larger and more agile organizations leverage automation and data-driven insights to reduce costs and improve customer experiences. The real challenge is not whether businesses should adopt AI — it is how they adopt AI safely and strategically. Organizations that approach AI implementation through a security and governance lens are far more likely to realize its benefits while minimizing exposure to risk. Offsetting AI Risks Through Governance and Security AI implementation should never occur in isolation from cybersecurity and business governance practices. Small businesses can significantly reduce their exposure by taking a structured and human-centric approach. Establish Clear AI Usage Policies Employees need guidance on:
Focus on Employee Awareness Technology alone cannot solve AI security challenges. Staff remain one of the most critical components of organizational security. Businesses should ensure employees understand:
Conduct Risk Assessments Before Adoption Before implementing any AI solution, businesses should ask:
Apply Cybersecurity Fundamentals Many AI-related risks can be mitigated through strong foundational cybersecurity practices, including:
The Role of Risk Management in AI Decision-Making Risk management plays a critical role in helping businesses balance innovation with security. Too often, organizations view cybersecurity as a barrier to progress. In reality, effective risk management enables smarter and more confident business decisions. Rather than asking: “Is AI safe?” Businesses should ask: “How do we implement AI while managing acceptable levels of risk?” This shift in thinking is important. Every business decision carries some level of risk — whether financial, operational, legal, or reputational. AI adoption is no different. The goal of risk management is not to eliminate all risk, but to identify, assess, prioritize, and control it appropriately. For small businesses, this means:
Human-Centric Security Matters More Than Ever As AI becomes more integrated into business operations, the human element of cybersecurity becomes increasingly important. Technology can strengthen productivity and resilience, but people remain central to secure decision-making. Businesses that combine AI innovation with strong governance, cyber awareness, and risk management practices will be far better positioned to succeed in the evolving digital landscape. The future of AI in small business is not about replacing people — it is about empowering them safely. Final Thoughts AI presents enormous opportunities for small businesses to improve efficiency, competitiveness, and growth. However, without proper governance and security considerations, those same tools can introduce significant risks. The organizations that will benefit most from AI are not necessarily the ones that adopt it the fastest, but the ones that adopt it the smartest. By embedding cybersecurity, human awareness, and risk management into AI decision-making processes, small businesses can confidently embrace innovation while protecting their operations, employees, customers, and reputation. AI should not be viewed purely as a technology decision. It is ultimately a business risk and resilience decision. “So I Get Hacked… What’s the Worst That Can Happen?” |
AuthorPatrick – Founder of Cyberplanz | Business Strategist | Cyber Governance Advocate Archives
June 2026
Categories |
RSS Feed
