How Cybermaniacs thinks about AI, HumanOS™, and your culture operating system
AI Didn’t Just Arrive. It Simply Arrived Inside People’s Heads.
When people started using GenAI at work, they didn’t wake up thinking:
“How can I responsibly apply AI within an appropriate risk framework today?”
They thought:
“Can this make my life easier?”
AI adoption is riding on top of all the usual HumanOS and culture dynamics you already have: People are overloaded and want to save time. They’re curious and enjoy playing with new toys. They may be under pressure to “be innovative” or “do more with less.” They already have habits around copy/paste, sharing, and side channels.
So you don’t just have “AI risk.” You have AI plus your current culture.
If your culture is already full of workarounds, late reporting, and ambiguous ownership, AI doesn’t fix that. It multiplies it.
The New Human Risks in the Age of GenAI
We’re not going to list every AI threat vector—that’s another blog. This is about the human risk patterns that show up when GenAI meets your existing culture.
A few big ones:
How GenAI Amplifies Your Existing Cyber Culture
Existing Culture Pattern
What People Do With GenAI
Resulting Human Risk in the AI Era
Workarounds are normal; secure way is too painful
Paste data into whatever AI tool is quickest or already open
Invisible data leakage, unlogged use of external AI, policy bypass
Fear of blame; people hide mistakes
Don’t report AI misuse, “dodgy” prompts, or near misses
You only learn about AI-related incidents when they’re already serious
Security seen as “the blocker,” not an enabler
Spin up shadow AI tools, personal accounts, unsanctioned plugins
Shadow AI estate, no oversight, inconsistent controls
Leaders quietly bypass rules when under pressure
Staff assume “speed beats safety” with AI as well
AI-generated content shipped without review or proper checks
Training is one-off, annual, and generic
No mental model for safe AI use in real workflows
Over-trust in AI outputs, poor judgment, role-specific blind spots
Reporting and challenge are culturally uncomfortable
People avoid questioning AI-generated content or “senior” requests
Easy wins for AI-powered phishing, deepfakes, and social engineering
1. Invisible Data Leakage Through “Helpful” Prompts
People paste what they work with: draft contracts, customer notes, internal strategy docs, snippets of code and configs.
They don’t always see it as “data exfiltration.” They see it as “help me rewrite this” or “summarize this for my meeting.”
If your guidance is vague, late, or hard to apply, the human OS will default to:
“I’ll just do it once; it’ll be fine.”
This isn’t fundamentally a technology problem. It’s a norms, clarity, and trust problem.
2. Over-Trust in AI Outputs (Especially Under Pressure)
Humans are great at over-trusting confident systems. Under time pressure, AI suggestions can feel like a lifeline:
“Draft me this email to the regulator.” “Write a secure configuration for X.” “Generate some code to do Y.”
If your culture doesn’t value skepticism, verification, and healthy challenge, you end up with AI-generated errors shipped as truth, subtle security weaknesses accepted because “the AI wrote it,” and decisions made without human accountability.
Again, the core question isn’t “is AI good or bad?” It’s:
“What do people around here believe about who is responsible for checking, correcting, and owning the outcome?”
3. Shadow AI and “Innovation by Workaround”
If the official stance on AI is unclear, overly restrictive, or stuck in permanent “draft policy” mode, people will find their own ways such as personal accounts on public tools, unapproved browser extensions, and internal “AI buddies” spun up without security review.
You’ve seen this movie before with SaaS, cloud, and messaging apps. The difference now is that AI tools can transform, memorize, and generate on top of your data at industrial speed.
When security and leadership send the signal “we don’t want to talk about this,” the culture will quietly decide:
“Then we won’t tell you what we’re doing.”
4. Social Engineering, Deepfakes, and Cognitive Overload
AI doesn’t just live inside your org—attackers are using it too.
Employees will face more convincing phishing and scam messages, synthetic voices and videos, and AI-generated documents that look “just right enough.”
The risk isn’t only technical. It’s cognitive and emotional: people are tired and busy, traditional “spot the bad spelling” tricks stop working, and your existing norms around verification and challenge either help or hurt.
If your culture doesn’t support slowing down, asking questions, and verifying requests, AI-enhanced attacks slot perfectly into your existing weak spots.
AI Through the NCSC Culture Lens
Even if you’re not formally under NCSC in the UK, their culture principles are a great way to frame AI. For each principle, ask:
What does GenAI do to this area?
Are we designing culture for that reality, or pretending AI doesn’t exist?
A few examples:
Security as an Enabler (Not Just a Blocker)
AI is a massive productivity lever. If your main message is “don’t use it,” you’ll lose.
The cultural question is:
“How do we make safe, approved AI use the easiest path for people who want to do good work?”
If you get this right, security is the team that gives people clear, usable AI guardrails, helps them find value safely, and collaborates with product, data, and legal to build trusted AI patterns.
If you get it wrong, AI innovation goes underground.
Safety, Trust, and Openness
People will make mistakes with AI. They already are.
If your culture punishes missteps, you’ll never see early warnings about data leakage, honest stories about how people are combining tools, or useful feedback about what’s confusing in your AI guidance.
Psychological safety around AI mistakes and near misses is now just as important as safety around phishing clicks and incident reporting.
Ability to Learn and Adapt
AI changes fast. Your culture has to as well.
You need short learning loops about how AI is actually being used, clear owners for updating guidance and controls, and a way to turn “we learned this from a near miss” into an update in weeks, not years.
If your culture is stuck in “annual policy refresh” mode, AI will outrun you.
Social Norms and Leadership Signals
How your leaders talk about AI is how your people will think about AI.
If leaders brag about “just dropping stuff into X AI tool,” ignore or bypass the guidance, or push for speed without mentioning risk, then that becomes the norm.
If leaders instead say, “We want you to use AI—but safely. Here’s what that means for us. Here’s how I use it and where I draw the line,” you start to build norms where responsible AI use is part of being a high performer, not a blocker.
Designing Human-First AI Culture: What Needs to Shift
We’re not going to give away a 40-step playbook here—that’s where we usually roll up our sleeves with clients—but there are a few big shifts in mindset every org needs.
1. From “Ban or Blind Eye” to “Guided Experimentation”
Pretending AI isn’t happening doesn’t reduce risk. It just pushes it into the shadows.
You need a culture where people feel invited to experiment within clear guardrails, they know what’s definitely not okay (e.g., sensitive data, confidential material, regulated content), and they know where to go with questions.
That’s not just a policy PDF. It’s tone, stories, and leadership behavior.
2. From “Training Once” to Continuous Micro-Learning
AI is moving too fast for a single, static training course.
People need short, timely explanations of new patterns (“Here’s what deepfake voice scams look like now”), contextual examples for their role (“Here’s how a finance leader should think about AI and invoices”), and quick decision aids (“If you’re about to paste data into an AI tool, ask yourself these two questions…”).
This is where creative, narrative-led micro content shines, things Cybermaniacs’ characters and storylines are built for.
3. From “AI is Magic” to “AI is a Tool Plus Human Judgment”
You want norms where AI is seen as a smart assistant, not an oracle, humans remain visibly responsible for checking and owning outcomes, and leaders model skepticism, verification, and transparency about how they use AI.
That’s a culture job as much as a tech job.
How Cybermaniacs Thinks About AI, HumanOS™, and Culture
When we work with organizations on AI and culture, we don’t start with:
“Here’s a generic AI policy template.”
We start with three questions:
What is HumanOS experiencing right now? Overload? Curiosity? Fear of being replaced? Pressure to “look smart” with AI?
How is AI actually being used in your real workflows? Sales, support, product, finance, leadership, engineering—where is it already embedded?
What do your organizational dynamics reward? Do people get recognized for speed, innovation, compliance, good judgment, early reporting?
Then we help you map your AI + culture risk in plain language, align it with the same NCSC-style principles you’re using for broader cyber culture, and design interventions—content, norms, leadership moves, and process tweaks—that move behavior in the direction you want.
Sometimes that looks like an “AI and me” campaign for staff that’s funny, honest, and practical; leadership sessions on how to talk about AI without overpromising or over-panicking; role-specific guidance and micro-dramas that show “good vs bad” AI use in context; and support to build AI-related metrics into your culture and human risk scorecards.
The key idea: your AI risk posture will only ever be as strong as your AI culture.
Key Takeaways: Human Risk in the Age of GenAI
A few things to keep front and center:
GenAI didn’t land in a vacuum; it landed in your existing cyber culture, with all its strengths and cracks. The biggest AI risks for most organizations today are human and cultural: data leakage via prompts, over-trusting outputs, shadow AI, and norms that reward speed over judgment.
NCSC-style cyber culture principles—security as an enabler, trust and openness, learning, norms, leadership, and usable guidance—apply directly to AI.
You don’t need to choose between innovation and safety. You need a culture that enables responsible AI use and treats mistakes as opportunities to learn, not just reasons to punish.
If you want AI to be an accelerator and not an uncontrolled experiment, the question isn’t just, “What AI tools do we buy?”
It’s:
“What kind of AI culture are we building—and what does that do to our human risk?”
As artificial intelligence (AI) tools evolve and proliferate, so too do the risks associated with their misuse. Attackers are leveraging AI to create...
Culture is often described as "what people do when no one is watching." In cybersecurity, this makes it both your greatest strength—and your greatest...
Team CM
