_网络安全文化的新时代——人工智能如何促进组织安全文化建设_29页_2mb

Cybersecurity culture is defined as the values, attitudes, and beliefs driving employee behaviors to protect organizations from cyber-attacks. It is holistic, ranging from individual to ecosystem levels, and is fostered through leadership, training, and managerial mechanisms.

The current state of cybersecurity culture maturity is assessed at an average rating of 3/5 across organizations, with levels ranging from ad hoc (unstructured) to dynamic (highly responsive). Challenges include resistance to change, lack of accountability, siloed approaches, and difficulties in measuring culture, with less than half of organizations actively tracking it.

AI can enhance cybersecurity culture by providing visibility into risky behaviors, improving efficiency through automation, enabling personalization (e.g., tailored training), quantifying human risk, and scaling security measures. This supports cyber Human Risk Management (HRM) and aligns with broader business goals.

Practical AI use cases include content personalization for training, measuring human risk scores, real-time risk recognition and interventions, tailoring security controls, automating access management, and AI chatbots for security guidance, all demonstrating potential to reduce cyber human risk.

To effectively use AI in culture transformation, organizations should outline aspirations, secure leadership support and investment, collect relevant data, explore and experiment with AI applications, consider new risks associated with AI, monitor progress, and prioritize the employee change journey with proper communication and training. KPMG's Trusted AI Framework emphasizes governance for transparency and accountability.

Seven key considerations for AI adoption in cybersecurity culture include prioritizing impactful use cases, ensuring data readiness, embedding trust through controls, starting with pilot projects, and integrating AI governance to mitigate risks like bias or misinformation.