“Security awareness has long meant teaching people to recognize a threat. AI is changing what that threat looks like. Emails, voices and video calls now arrive looking credible, urgent and familiar. Today, trust itself has become a new attack surface. In fact, Gartner’s September 2026 survey found 41% of CISOs reported a deepfake-led social engineering incident on an employee audio call in the past year, with 36% on a video call. That makes ‘spot the scam’ an unreliable defense. Awareness now must translate into action, with verification built into the work itself. The right question is not whether an employee can tell if a message is AI-generated, but whether the organization has designed the workflow to prevent a single deceptive interaction from becoming a security incident. This extends to AI agents working inside enterprise systems, which need their own identity, limited access and an audit trail. For high-risk actions such as payment approvals, access changes and sensitive data sharing, confirmation should go through a trusted channel, however convincing the request seems. The focus should be on creating a culture of practical security behaviours, where employees know when to pause, verify and escalate. Verification triggers and escalation paths must be clearly defined, regularly tested through simulations and measured like any other security control. Deliberate verification will be as important as improving detection technology.” – Achyuth Krishna, Head of IT, Information Security and Procurement at Whatfix