Not Making It Easy for Attackers Also Starts with Catching What Slips Through

Security is built on the small decisions we make each day. That’s why Cybersecurity Awareness Month 2026 focuses on the habits that make life harder for attackers—such as using strong passwords, enabling multi-factor authentication (MFA), recognizing and reporting scams, and keeping software updated. However, security awareness must also address the risks that arise when employees introduce new applications and services into their work.

Artificial intelligence (AI) is already being used to answer questions and handle tasks, but company policies and guidelines haven’t always kept pace. When there aren’t any approved alternatives that meet their needs, or when all AI use is blocked outright, employees may turn to services the company hasn’t yet evaluated—making it harder for the security team to maintain visibility. This calls for expanding security awareness with examples that help people understand what information is being shared, who might see it, and what an application can do on the user’s behalf.

That last point becomes even more critical with AI agents: asking for help to draft an email is very different from authorizing an agent to access your inbox and act for you. Giving these tools access to email, files, and calendars means granting permissions that a threat actor could exploit if an account is compromised or credentials are stolen. If an assistant can check all the company’s meetings when it only needs one user’s schedule, a single breach could expose organization-wide information. So AI accounts must be protected with the same care as any other account handling sensitive data—using MFA wherever available and auditing authorizations used to connect other services.

Training must therefore explain why it is important to pause when faced with an unexpected access request and verify whether the permissions match the work in question. At the same time, companies need to acknowledge that AI is already being used—even if their security team hasn’t approved every application—and understand which services are being used and what level of access they have.

Understanding Use Cases to Decide How to Protect Them

Chatbots, add-ons, extensions, and AI integrations used outside of approved processes are part of what is known as shadow AI. These practices can persist even when policies are in place. If a company is unaware of these connections to corporate resources, it may leave access points out of its security reviews, which attackers could exploit.

To gain visibility, companies need to monitor applications connected to their cloud environment, authorizations granted from corporate accounts, and unmanaged integrations. This helps uncover unknown services and verify what information they can access and with what permissions. Connecting these integrations to account activity helps spot behaviors that require investigation.

The goal is to turn that insight into concrete action: reviewing the permissions of a risky integration, revoking an unnecessary authorization, or investigating potential account misuse. Supervision must continue even after an application is approved as its access levels and configurations can change. 

This information also helps improve security awareness. Knowing which services employees are using makes it easier to provide guidance on real-world scenarios, identify where approved alternatives are lacking, and clarify what data can be shared with AI, what must be left out, and who to consult in case of doubt. In this way, training and monitoring reinforce one another: employees can report new use cases, while the security team maintains the ability to discover those passing under the radar.

An Encrypted Connection Can Also Carry Threats

However, knowing an application and its permissions isn’t enough to detect all the threats moving through its connections. The WatchGuard Global Threat Report H1 2026 reveals that 95% of the malware observed on the network arrived via encrypted TLS connections, while only 20% of Fireboxes were inspecting that traffic.

Encryption protects data while it is in transit, but it can also hide malicious content from security controls. Consequently, cloud visibility must be supplemented by reviewing where HTTPS inspection is applied and what traffic is excluded. This inspection decrypts traffic, scans it for threats, and re-encrypts it, applying whatever compatibility checks and exceptions each environment requires.

This data doesn’t imply that the malware originates from shadow AI, but it reveals another limit of visibility: identifying a service isn’t the same as examining what it exchanges. Uncovering applications and access points helps reduce exposure, and inspecting their connections helps detect threats that might otherwise remain hidden.

This Cybersecurity Awareness Month offers a chance to check whether your security awareness initiatives address these habits and whether your controls enable you to manage the risks involved. Not making it easy for threat actors also starts with knowing what applications are being used, what data they handle, and what permissions they retain, ensuring that blind spots aren’t created in your company’s security posture.