Almost two thirds of workers have received no training on AI-driven cyber threats in the past 12 months, according to research from the technology and cyber security training provider QA, released to mark Cyber Security Month.
The survey found that 61 per cent of workers had been given no training of any kind on threats such as AI-generated phishing emails over the past year. QA said one in three workers admitted they could not spot an AI-generated phishing email.
More than one in five respondents (22 per cent) said their organisation had no policies in place for combating AI-driven threats, which QA said range from phishing emails and deepfake voice scams to AI-generated fake invoices.
Where training had been received, 25 per cent of respondents said it was specific to AI-driven threats, QA said. A further 30 per cent said AI threats had been covered only as part of generic cyber security training.
QA reported a gap in confidence between job roles. Nine per cent of non-management workers said they were very confident they could spot an AI-generated phishing email, compared with 48 per cent of owners and partners and 33 per cent of board directors.
The company said the figures suggested a need for training to be filtered down through workforces. Business Matters has previously published guidance on role-based phishing training, in which exercises are tailored to the scams that different teams are likely to receive.
By age, QA said 18 to 24-year-olds were the least confident, with 39 per cent admitting they were worried about being caught out. The company suggested that Generation Z’s exposure to media may give that age group a better grasp of how convincing AI-generated content can be than less digitally experienced generations.
Dr Vicky Crockett, portfolio director for AI at QA, said: “It’s clear from the survey data that organisations need to build the foundations on basic AI literacy, so that business leaders and workers feel confident in spotting these threats.
“When it comes to training, it’s imperative that all job roles can positively spot any AI-driven cyber threats, but when it comes to AI training, there’s no one size fits all, so combining baseline AI literacy learning with job specific training is usually the best fit.”
Jo Bishenden, chief learning officer at QA, said: “The findings suggest organisations are facing a skills challenge as much as a cybersecurity challenge. AI is changing the way people work, but many employees are not building the skills they need to understand the risks and opportunities that come with these new technologies.
“As AI becomes part of everyday working life, businesses need to invest in building AI literacy, cyber awareness and digital confidence across the entire workforce. Through the right skills training, apprenticeships and continuous learning programmes, organisations can equip their people with the skills they need to work safely, adapt to change and make the most of emerging technologies.”
The findings follow official figures on staff training. The government’s Cyber Security Breaches Survey 2025/2026, published on 30 April, found that 19 per cent of UK businesses had run cyber security training or awareness sessions for staff in the previous 12 months, unchanged on the year before. The proportion was 14 per cent among micro businesses and 84 per cent among large businesses.
The same survey, commissioned by the Department for Science, Innovation and Technology and the Home Office, found phishing remained the most common type of breach or attack, experienced by 38 per cent of businesses. Interviewees told researchers they believed phishing had become easier for attackers to carry out.
It also found that 31 per cent of businesses were using AI, adopting it or actively considering it. Of that group, 24 per cent reported having cyber security practices or processes in place to manage the risks from the technology.
Separate research from the skills company Pluralsight, reported by Business Matters on Wednesday, found that while 94 per cent of UK organisations had invested in AI tools for at least some employees, 48 per cent said most or all of their staff were AI literate.
