Cybersecurity does not fail only because technology fails.

Sometimes people are busy. Sometimes they are rushed. Sometimes the safest choice takes too many steps.

That human side of cybersecurity took center stage during the National Cybersecurity Alliance’s Oct. 1 webinar kicking off Cybersecurity Awareness Month 2026.

“The problem isn’t lack of information, but the gap between awareness and action,” said Lisa Plaggemier, executive director of the National Cybersecurity Alliance.

For Texas public pension systems, that gap matters.

Retirement systems hold sensitive data, manage financial information, work with outside vendors, and rely on technology for daily operations. Trustees may not be cybersecurity specialists, but boards and administrators help set the policies, expectations and resources that determine how a system responds when something goes wrong.

And the risks are changing quickly.

Artificial intelligence is giving defenders new tools. It is also helping criminals produce attacks faster, personalize messages, and create convincing voice and video impersonations.

That means stronger cybersecurity cannot depend on technology alone.

Knowing and doing are different things

The National Cybersecurity Alliance and CybSafe surveyed 5,000 adults in the United States, United Kingdom, India, Brazil and Singapore for a new Oh, Behave! Cybersecurity Attitudes and Behaviors Report.

Plaggemier previewed some of the results during the webinar.

Eighty-three percent of respondents said digital security was a top priority. Seventy-three percent said they knew how to create a strong password.

Yet 46% still used dictionary words in passwords, 38% used personal information in them and 53% did not use multifactor authentication, or MFA, regularly.

The problem, Plaggemier said, is not asking everyone to become a cybersecurity expert. It is getting people to consistently practice a handful of behaviors that make attacks harder.

Those include using long, unique passwords, turning on MFA, installing updates, slowing down when messages create pressure or urgency and being cautious about unknown callers or senders.

The findings continue a trend identified in NCA and CybSafe’s five-year review of cybersecurity behavior from 2021 through 2025.

That report found people increasingly understood cybersecurity but struggled to turn that awareness into routine action. Its authors summarized the trend this way: “We’re getting better at knowing and worse at doing.”  

For pension systems, that suggests cybersecurity training should be measured by more than whether someone completed it.

The question is whether behavior changed afterward.

Stop designing for the “perfect user”

Margaret Cunningham, vice president of security and AI strategy at Darktrace and a field chief information security officer, said security programs also need a more realistic view of employees.

“We have to stop designing things or pretending that there’s a perfect user,” Cunningham said.

People do not work exactly the same way every day, she said. Policies and security tools have to reflect how employees actually perform their jobs.

“If we’re really slowing everybody down, they’re going to go around, and that creates a whole different layer of risk,” Cunningham said.

That lesson can apply directly to pension systems.

A security rule may look strong on paper. But if it makes routine work difficult enough that employees seek a shortcut, the rule may create a different risk.

Nicole Dove, head of customer value and community at Frame Security, put the issue another way.

“Cybersecurity problems are really people problems,” she said.

Attackers are people. Victims are people. Employees write policies, manage systems and report suspicious activity.

Dove said security programs should focus more closely on the situations employees are likely to encounter and give them useful ways to respond.

Measure behavior, not attendance

That approach also changes what organizations should measure.

Plaggemier said traditional awareness programs have often focused on participation, quiz scores or whether employees clicked on simulated phishing messages.

Those measures do not always reveal whether behavior has changed.

She pointed to password managers as an example. Organizations trying to increase adoption can examine whether employees are actually using the tool, whether passwords are stronger and whether people are using unique passwords across more accounts.

Dove said organizations also should look for cultural changes.

If employees feel comfortable reporting something suspicious, incident reporting may increase. That can be a positive sign, not evidence that security is getting worse.

Employees should feel they can say, in effect, “I’m not sure about this, but I know the security team wants to hear about it.”  

For pension administrators and trustees, that can lead to a different set of questions.

Are employees reporting suspicious messages? Are they using MFA? Are they following procedures when something looks wrong? Has the system tested whether training changed behavior?

Those questions move the discussion beyond checking a box.

AI makes old attacks faster

Artificial intelligence is changing the scale of the threat, even when the basic attack is familiar.

Dove said attackers are not necessarily inventing entirely new ways to attack organizations.

“They’re attacking us the same way, but it’s just so much more rapidly,” she said.

AI has lowered the barrier to entry, allowing criminals to research targets and personalize attacks much faster. At the same time, defenders can use AI to strengthen their own security programs.

The familiar, badly written phishing email is also becoming less reliable as a warning sign.

Misspellings and awkward grammar can disappear when AI writes the message. Attacks can include context about the target and be produced at scale.

“Everything is perfect,” Plaggemier said during the discussion of AI-generated phishing.

That makes habits such as independent verification more important.

Employees may need to rely less on whether a message “looks wrong” and more on established procedures for confirming unusual requests involving money, credentials or sensitive information.

Deepfakes are already here

The same concern extends beyond email.

Dove pointed to cases in which deepfake participants appeared during video calls connected to high-dollar financial transactions. She also said deepfakes are appearing in recruiting, allowing bad actors to impersonate job candidates and potentially gain access to company systems.

“This is not a futuristic attack,” Dove said. “It is very much present and very real.”  

Cunningham said the technology has reached a point where organizations cannot assume people will always recognize the fake.

“We’re all going to fall for it, all of us,” she said.

Her point was not that people should give up. It was that organizations need systems that assume mistakes will happen and limit the damage when they do.

That concept is particularly relevant when employees can authorize payments, access member information or handle other sensitive transactions.

The goal is not to create a workforce that never makes a mistake.

It is to build enough layers around those decisions that one mistake does not become a major incident.

Employees are already using AI

AI also creates risks from inside the organization.

Plaggemier said 80% of respondents in NCA and CybSafe’s new survey use AI tools. More than half of AI users had received no security or privacy training on those tools.

Nearly one-third of employees who used AI at work said they had shared sensitive company information with an AI tool without their employer knowing.

That does not necessarily mean employees are trying to break rules.

Plaggemier said people may simply be using an easy, useful technology without clear guidance about where the boundaries are.

Dove made the same point later in the webinar.

“People are not waiting for the AI policy,” she said.

For retirement systems, that makes AI governance part of cybersecurity.

Systems may need clear rules explaining which AI tools can be used, what types of information can be entered into them and how work and personal AI accounts should be separated.

But those policies also need to start with a basic question: How are employees already using AI to do their jobs?

Practice before something goes wrong

Cybersecurity training may also need to become more hands-on.

“Don’t just tell people what to do,” Dove said. “Really give them opportunities to practice it.”

Practice, she said, helps create the “muscle memory” employees need when a real situation occurs.

That principle reaches beyond phishing exercises.

CISA’s 2026 recommendations call on organizations to develop, maintain and regularly exercise incident response plans for threats such as ransomware. Those drills should include leadership and legal counsel, not only technical staff.

Organizations should also prepare for major system disruptions and know how critical functions will continue while systems are unavailable.

For pension systems, that can lead to practical questions.

How would essential benefit operations continue during an outage? Who communicates with members? Who contacts legal counsel, insurers or outside cybersecurity specialists? Who has the authority to make decisions?

Those are easier questions to answer during an exercise than during an attack.

Make the safer choice easier

Cybersecurity Awareness Month puts online security in the spotlight each October.

But the message from this year’s kickoff was that awareness is only the beginning.

People may understand that cybersecurity matters and still reuse a password, delay an update, skip MFA or respond too quickly to a convincing message.

Security programs have to account for that reality.

The technology matters. Policies matter. Training matters.

But so does the person trying to get through a workday.

For pension leaders, the goal is not to create perfect users. It is to build systems, policies and habits that make the safer choice easier to make, and make a mistake less damaging when it happens.

---

About the Author: Allen Jones is the director of communications and event marketing for TEXPERS, where he leads editorial strategy, member communications, conference marketing, and digital engagement initiatives for Texas public employee retirement systems. He began his journalism career in 1998 and has worked in journalism and communications for more than 25 years.