Addressing the human element in cybersecurity

October is Cybersecurity Awareness Month, and as AI reshapes the cybersecurity landscape, organizations must rethink both their technology and their talent. Following her keynote at the ONE Conference – Europe’s premier cybersecurity event – Kyndryl Global Security and Resiliency Practice Leader Kris Lovejoy discusses how the emergence of AI-powered threats is transforming approaches to cybersecurity.

The threat landscape is evolving rapidly with AI-powered attacks becoming more sophisticated. How are adversaries using AI differently now, and what does this mean for defense strategies?

Adversaries are deploying AI agents that learn, adapt and coordinate in real time, often faster than traditional defenses can respond. Nation-states and cybercriminals are using AI to automate and scale operations. This demands a shift to AI-native security architectures. We need systems that govern behavior, anticipate emerging risks and respond to threats before they materialize. Defenses must evolve as fast as the threats do.

AI is accelerating change across industries. How is it specifically reshaping cybersecurity roles?

AI is fundamentally altering the nature of cybersecurity work. We’re seeing a shift from tactical, reactive roles to strategic ones that require deep skills in AI governance, risk management and critical thinking. As automation increasingly handles routine tasks, more cybersecurity professionals are overseeing autonomous systems. These agents aren’t just execution tools; they make active decisions (and will increasingly tackle more sophisticated decisions as they are trained and get smarter). That means our cybersecurity teams must evolve to focus on issues of trust, governance and compliance of these digital actors.

Those who adapt quickly will be able to transform industry disruption into strategic advantage. 

You’ve emphasized the need to retrain the workforce. What does that look like in practice?

The need to retrain is urgent, and not optional. We need to equip cybersecurity professionals with new competencies, including understanding AI behavior, managing digital identities for autonomous agents, and building observability systems that track the decisions of AI agents.

What’s your call to action for organizations navigating this transformation?

Start now. The first step is recognizing that traditional cybersecurity frameworks were not built for the agentic AI era. Organizations need to invest in governance platforms, upskill their teams, and establish effective cooperation and communications protocols among security, legal and compliance. Those who adapt quickly will be able to transform industry disruption into strategic advantage. Meanwhile, those who delay will increase their risk of being overwhelmed — not only by external threats, but also by the unintended consequences of their own autonomous systems.

Kris Lovejoy

Kyndryl Global Security and Resiliency Practice Leader