Trust Alone Is No Longer a Security Control

For years, cybersecurity awareness training has focused on helping employees identify suspicious communications. Check the sender, look for mistakes, question unusual requests. 

But artificial intelligence is changing the rules. 

Today, cybercriminals can generate convincing emails, clone voices, and impersonate trusted individuals with unprecedented accuracy. The challenge is no longer spotting obvious scams. It's recognizing that many malicious communications may appear completely legitimate. 

Our latest Cyber Trust Index reveals a concerning disconnect. While 46% of employees say they trust digital communications more today than they did five years ago, 55% admit they do not consistently verify sensitive requests before taking action. 

To me, this is one of the most important findings in the research. As digital interactions become harder to authenticate, employees are becoming more confident, not more cautious. That's precisely the opposite of what organizations need in an era of AI-powered impersonation. 

The data also suggests that people continue to place significant weight on familiarity. 72% of employees say they have clicked a link or opened an attachment because it appeared to come from someone they knew. 

That behavior is understandable. Trust is how businesses function. The problem is that attackers increasingly know how to exploit it. 

Historically, a familiar name, recognizable writing style, or known contact might have been a reliable signal. Today, AI allows threat actors to replicate many of those signals at scale. What employees see as evidence of legitimacy may actually be evidence of a sophisticated impersonation attempt. 

The same challenge extends to leadership. Our research found that 76% of employees trust managers and senior leaders when making important workplace decisions. 

That's not a problem in itself. In fact, strong leadership trust is often a sign of a healthy organization. However, it also helps explain why executive impersonation remains one of the most effective social engineering techniques. Attackers understand that employees are naturally inclined to respond quickly when a request appears to come from someone in authority. 

The key lesson from this research isn't that organizations should trust less. It's that they need to make verification a normal part of business operations. 

Employees shouldn't verify requests because they seem suspicious. They should verify them because they're consequential. 

If a request involves money, credentials, sensitive information, or changes to established processes, verification should be routine, regardless of who appears to be sending it. 

In the AI era, trust remains essential. But trust alone is no longer a security control. 

The organizations that will be most successful over the next decade won't be those that eliminate trust from their culture. They'll be the ones that strengthen it with simple, repeatable verification practices that help employees make better decisions when it matters most. 

Download the Cyber Trust Index to learn how employee trust, verification habits, and AI-driven threats are reshaping cybersecurity preparedness around the world.