For many years, cybersecurity has had a clear goal. Build secure systems, write secure code, design strong architecture, add controls, encryption, monitoring, and access management. If we did those things well, we believed the organization would be safe.

And humans were part of the discussion, but usually in a simple way. They were trained in security awareness once a year, shown slides about phishing, and sent a few reminder emails. Then we went back to what we thought really mattered. Systems.

That model worked reasonably well in a slower world, but it does not work anymore.

Today, the most important security control in many organizations is not written in code or configured in systems. It lives inside the decisions people make every day. Security by design is still essential. But it is no longer enough, especially now in the age of AI. What we need now is Culture by Design.

AI Has Shifted Where Risk Lives

Beyond introducing new tools, artificial intelligence changed where risk appears inside organizations. In the past, most security risks came from a few expected places: vulnerable software, misconfigured systems, external attackers, and phishing emails. Today, risk often appears somewhere far less obvious: inside everyday normal work.

A marketing employee uploads sensitive customer data to an AI tool to generate campaign insights. A developer asks an AI assistant to refactor internal code, unknowingly sharing proprietary algorithms. A finance employee uses an AI tool to summarize confidential contracts. None of these people are malicious. Most are simply trying to work faster. The problem is that in doing so, they may expose intellectual property, personal data, or information that should never leave the organization.

This is a behavior moment, not a technical failure. And that is exactly where traditional security programs struggle. Because awareness does not create behavior.

Awareness Does Not Create Behavior

Most organizations respond to new risks with awareness campaigns, posters, training videos or policy changes. These help people understand the problem, but they rarely change what happens in the moment that matters. When someone is under time pressure, awareness fades. Speed and convenience win. And AI tools make this even more acute, because they promise massive productivity gains, and nobody wants to be the one left behind.

So, if security depends on people remembering rules in stressful moments, the system is inherently fragile by design. This is why the conversation must change. We must design for secure behavior, not just secure systems. And this is where the discussion about organizational culture begins.

“We must design for secure behavior, not just secure systems.”

Where Security Ends and Culture Begins

There is an invisible line in every organization where technology stops controlling risk and behavior takes over. A company may have perfect access controls, but if employees regularly share credentials to save time, the control collapses. A company may have secure development pipelines, but if engineers paste sensitive code into external AI tools, intellectual property leaks. A company may even have strict data classification, but if employees upload files into AI tools to “see what happens,” data protection fails.

The systems were secure. The culture was not.

And in the age of AI, this boundary appears earlier and earlier in the process. That is why we must start thinking differently. Security cannot stop at architecture and system configuration. It must continue into the human realm of behavior.

Real AI Risks That Demand Cultural Change

Security by design is still one of the most powerful ideas in cybersecurity. But AI forces us to extend this concept so that security must move through the entire lifecycle, permeating architecture, development, operations, and human decision-making. When you hand someone a powerful tool, you also hand them the responsibility to use it safely. When organizations deploy AI assistants, the question is not only “Is the tool secure?” The question becomes “How will people actually use this tool?”

Here are some examples of what can happen and has happened. The following incidents are not theoretical. They are documented, named, and already on the record.

1.  Source code exposure: Samsung, 2023

In March 2023, Samsung allowed engineers to use ChatGPT for coding tasks. Within twenty days, three separate incidents occurred: proprietary source code pasted in to fix bugs, confidential chip-testing code submitted for optimization, internal meeting transcripts uploaded to generate minutes. ChatGPT’s interface at the time used inputs to train its models. Samsung’s semiconductor IP was now on OpenAI’s servers with no way to retrieve it. No scanner detected this. No alert fired. The engineers were solving real problems with a tool that worked. The failure was entirely cultural.

2.  AI-generated attacks at scale: WormGPT and FraudGPT, 2023

In July 2023, SlashNext uncovered WormGPT, a blackhat AI tool sold on hacker forums, trained on malware data, no guardrails. Researchers used it to generate a phishing email they described as remarkably persuasive. Weeks later FraudGPT appeared on dark web channels: phishing generation, malicious code writing, scam pages, $200 a month, over 3,000 confirmed sales within weeks. Attackers can now run personalized social engineering campaigns at a scale and quality previously impossible without skilled human writers. Your culture determines whether your people pause or click when one of those emails lands.

3.  Decision integrity and legal liability: Air Canada, 2024

In 2022, a passenger consulted Air Canada’s chatbot about bereavement fares, received incorrect advice, followed it precisely, and was denied the refund he was promised. Air Canada argued to the tribunal that the chatbot was a separate legal entity responsible for its own actions. The tribunal called that argument remarkable before rejecting it entirely, ruling the airline liable for negligent misrepresentation. Organizations are accountable for every output their AI systems produce. That is now settled law.

Culture by Design

The traditional Security by Design principle still holds: build security in from the start, not as an afterthought. But in the age of AI it needs to expand its scope significantly. Your attack surface now includes the tools your engineers use to write code, the AI assistants your analysts use to summarize threat intelligence, the chatbots your customer service teams deploy, and the AI agents taking autonomous actions inside your environment. Each needs security thinking at the design stage, not the incident review stage.

And designing culture may sound abstract, but it is not. Just like systems architecture, culture can be engineered. It requires proactive intention and three critical elements.

Leadership signals: People watch what leaders reward. If speed and innovation are celebrated but safe behavior is ignored, employees will choose speed. If leaders openly discuss responsible AI use, teams follow. Culture is shaped by signals more than policies.

Friction in the right places: Good security design places friction exactly where risk appears. AI tools should include reminders about sensitive data. Data loss prevention tools should detect risky prompts. Internal AI systems should exist so employees do not need to reach for external ones. When friction appears at the right moment, behavior changes naturally.

Shared responsibility: Security teams cannot monitor every AI interaction. Responsibility must move closer to the people using the tools. Developers must understand data boundaries. Marketing teams must understand data classification. Finance teams must understand AI data risks. Security becomes a shared language, and that is a cultural aspect.

How to Implement Culture by Design

Think of cybersecurity today as three layers. Layer one is technology: encryption, identity management, monitoring, secure infrastructure. Layer two is process: policies, governance, compliance, risk management. Layer three is culture: daily behavior, decision-making, accountability.

In the past, organizations invested heavily in the first two layers. The third received awareness training once per year. But in the age of AI, the third layer may be the most important one, because AI moves power, and the risk, closer to individuals.

Below is a practical step-by-step approach that organizations can follow.

Step 1. Identify the Moments That Matter

The first step is mapping the exact situations where risky decisions occur during daily work. In the age of AI, these moments usually appear when employees paste data into AI tools, or upload documents for analysis, or generate code using AI assistants, or automate workflows using AI, or simply rely on AI output for business decisions. The goal is to identify where human decisions interact with powerful tools. Once these moments are known, the organization can design expected behavior around them.

Step 2. Define the Secure Behavior

After identifying the moments that matter, define clear and observable secure behaviors. Employees should know exactly what action is expected. Some examples can be that customer data must never be pasted into external AI tools, or internal source code can only be used with approved AI development assistants, or confidential documents must only be processed through internal AI platforms, or AI generated output must be verified before operational use. This removes ambiguity and makes behavior measurable.

Step 3. Make the Secure Choice the Easy Choice

Security culture fails when secure behavior is harder than insecure behavior. Employees will choose convenience by default, so organizations must, therefore, create environments where the secure path is also the fastest most convenient path. Some examples can be the deployment of internal AI assistants for coding, writing, and analysis, or the integration of AI tools directly into development environments, or providing internal easy access document analysis AI systems, or automatically warning users when sensitive data is pasted into prompts. When employees have safe tools conveniently available, risky behavior decreases naturally.

Step 4. Send Clear Leadership Signals

Security culture spreads through leadership behavior. Employees pay attention to what leaders praise, ignore, or tolerate. Leadership must unanimously communicate that responsible AI usage is part of professional conduct. Practical actions include leaders openly discussing AI risk and responsibility, or including responsible AI usage in performance discussions, or supporting teams that pause work due to security concerns related to AI risks. When leadership signals are visible, culture becomes consistent.

Step 5. Embed Security Signals in Daily Work

Security reminders should appear in the tools employees already use. This makes secure thinking part of normal work. Examples include prompts warning about sensitive data before AI submission, or security reminders inside developer AI tools, or classification tags visible when documents are uploaded. These signals influence behavior at the moment decisions are made.

Step 6. Encourage Safe Experimentation

Employees are curious about AI. That curiosity should be guided, not suppressed. Organizations should provide safe environments where experimentation can happen without exposing sensitive data.

Examples of this can be found in AI sandboxes using synthetic data, or experimentation environments isolated from production systems, or internal AI communities sharing best practices. This reduces shadow experimentation.

Step 7. Measure Real Behavior

As mentioned before, awareness metrics alone do not reflect culture. Not even close. Organizations must measure observable actions. Behavior based measurements show how people actually interact with AI tools. Examples of measurable actions can be found in attempts to paste restricted data into AI tools, or number of risky prompts detected, or adoption of secure AI platforms, or security incident reports related to AI usage. These metrics reveal whether culture is improving.

Step 8. Treat Culture as a Security Control

The final step is recognizing that culture is not an abstract idea. It is a security control layer. It should be managed like other controls such as vulnerability management or identity security. That means assigning ownership, defining measurable outcomes, reviewing metrics regularly and improving your culture programs continuously. When culture is treated this way, it becomes part of the security architecture.

The Control We Forgot to Design

We have spent decades getting very good at protecting things. Systems, networks, code, data. We built walls, designed gates, wrote rules into architecture, and called it security. And in many ways, it worked.

But there was always a part of the organization we never fully designed for. The part that does not run on servers. The part that shows up at 9 am, checks its messages, opens a browser, and starts making decisions. We knew it was there. We just assumed awareness would be enough to keep it safe.

It was never enough. We just did not feel the gap until AI made it impossible to ignore.

Now the question is not whether your systems are secure. Most of them probably are. The question is whether your culture is. Whether the people inside your organization understand the power the tools in front of them carry, and whether they have been genuinely prepared to use that power responsibly. Not trained. Prepared. There is a big difference, and it is that difference that matters now.

The organizations that treat culture as a design problem, with the same intention and rigor they bring to their technical architecture, will be the ones that are genuinely resilient in the years ahead. Not because they will never have incidents. But because when the moment comes, and it will come, their people will know what to do.

Build the culture deliberately. Because the most dangerous security gap in your organization today is not in your code or your systems. It is in the space between what your people know and how they actually behave when nobody is watching.

The architecture protects the perimeter. Culture protects the moment.