Two in five UK workers lack training on AI-powered cyber threats

UK businesses are being urged to update their cyber security training after research found that 39% of workers had received no training on AI-powered threats in the previous 12 months.

The survey of 1,000 UK workers, published by technology training provider QA, also found that 35% were not very confident, or not at all confident, that they could recognise an AI-generated phishing email. The findings show a potential gap in business defences as attackers use AI to make fraudulent communications more convincing.

The research, conducted by TLF on 24 September 2026, found that only 25% of employees had received dedicated training on AI-driven cyber risks. Among non-management employees, 61% reported receiving no training on these threats.

AI makes familiar attacks harder to spot

Ali Kazmi, principal learning technical specialist at QA, said AI was improving attackers’ ability to research organisations, identify targets and impersonate trusted contacts.

“Poor spelling is no longer a reliable warning sign that a message isn’t legitimate,” he said.

Using publicly available information or compromised communications, criminals can create messages that reference real projects and mimic colleagues, reducing the value of familiar warning signs such as awkward wording.

The UK’s National Cyber Security Centre has independently warned that AI will almost certainly make elements of cyber intrusion more effective and efficient, increasing the frequency and intensity of threats.

Its assessment of the threat through to 2027 says attackers are almost certainly already using AI for reconnaissance, social engineering, vulnerability research and basic malware generation. It expects much of the increased threat to come from improvements to existing techniques.

For aerospace, defence and security suppliers, this raises a practical question: how should staff verify requests that appear to come from familiar customers, programme partners or colleagues?

Phishing remains the dominant UK threat

The government’s Cyber Security Breaches Survey 2025/2026 found that 43% of UK businesses had identified a breach or attack during the previous 12 months.

Among affected businesses, 88% reported phishing, compared with 85% in the previous survey cited by QA. However, phishing prevalence across all businesses was broadly unchanged year on year. These figures do not establish how many attacks involved AI.

The NCSC also warns of a widening gap between organisations keeping pace with AI-enabled threats and those whose defences fall behind. Training therefore forms part of a wider resilience challenge alongside technical protection.

Training needs to reflect real decisions

QA argues that businesses should tailor training to the requests employees encounter in their roles. Finance teams need to practise verifying bank-detail changes, service desks need consistent identity checks, and all employees need clear routes for reporting suspicious requests.

“Organisations need training that reflects today’s threat landscape, particularly around AI-enabled impersonation, social engineering, and verification behaviours,” Kazmi said.

For employers, the priority is to make verification a routine part of work. A convincing message should still face established checks before anyone changes payment details, grants access or releases sensitive information.