AI Security Training Needs a Human Decision Layer

Last updated: November 3, 2026

AI writing is easy to recognize. Look for the em dashes, the repeated use of “delve,” or the generic declaration that leadership has been “unlocked.” The reaction is understandable: these details can make polished prose feel interchangeable.

But the answer is not to reject every use of AI. Tools can make information quicker to locate, easier to understand and more practical to use. The more important distinction is between supporting the person making a decision and making that decision for them.

That distinction sits at the center of KnowBe4 Lead CISO Advisor Javvad Malik’s position: AI can support information and efficiency, while human judgment remains responsible for intent, context and the human element of communication.

Information and behavior are separate jobs

A dishwasher error provides a useful example. When a machine stops working, a model number, error code and a poorly filmed repair video may be enough to solve the problem. Production quality is secondary if the information works. The viewer does not need to feel a personal connection with the person in the garage; they need an answer.

Security awareness has a similar information layer. KnowBe4’s practical training modules teach people to recognize phishing red flags, transfer data securely and classify it appropriately. AI can help make this knowledge more accessible without changing the underlying lesson.

Behavior is different. Knowing that a credential-harvesting message is dangerous does not automatically change what someone does when confronted with one. The person must recognize the warning, understand its consequences and choose a safer response.

That is where storytelling earns its place. KnowBe4’s “The Inside Man” is designed like a dramatic series rather than a conventional training module. Viewers are not watching to understand the mechanics of a credential-harvesting attack. They are watching characters face the consequences of poor decisions. Information supplies the facts; drama can make those facts matter.

Where AI helps—and where it does not

AI is well suited to reducing friction. It can shorten meeting notes, help locate useful material and review a draft before it reaches an editor. The person still decides whether the result is accurate, useful and appropriate.

The same principle applies to security training. AI can support the creation of information, but it should not become the authority on what matters in a particular situation. Context can disappear when a system optimizes for a technically correct answer. A warning may be accurate yet poorly timed, unclear or disconnected from the decision it is supposed to influence.

Human oversight is therefore not simply a box to tick. Someone must retain responsibility for the recommended behavior. That person needs to judge whether the explanation reflects the real environment and whether users can follow it without creating new problems.

This creates a clear trade-off. Hand too much authority to the tool, and polished output may be mistaken for effective training. Remove AI entirely, and teams may waste time on repetitive work that the technology could handle. The stronger approach is to let AI support the preparation and delivery of information while people remain accountable for the decisions around it.

Who should care

• Security leaders should care because faster access to information does not guarantee safer decisions. Their teams need to know which judgment remains human and which outcomes demonstrate that training works.
• Learning and content teams should care because factual instruction and emotional engagement are not interchangeable. AI can reduce production effort, but human creators still need to shape the framing, tone and meaning that connect with the audience.
• Business owners should care because security guidance must fit actual work. A technically sound instruction is less useful if employees cannot apply it within their normal routines.
• AI-agent owners should care because KnowBe4’s platform addresses security for both people and AI agents. As agents become part of the workforce, human accountability cannot become less clear.

The test is behavior, not polish

The dishwasher video works because it solves a problem. It does not need to be beautifully produced. A training module should face the same test: does it give the learner what they need to make a safer decision?

That means reviewing AI-supported content for technical accuracy, relevance and realism. It also means looking beyond whether the material was delivered or completed. The more meaningful question is whether people recognize the danger, understand the consequences and take the appropriate action when the moment arises.

Malik’s approach also preserves room for imperfection. Human writing may contain unconventional grammar or unusual choices of words, but those choices can carry personality and make the material easier for a particular audience to understand. AI can assist with concision and efficiency, provided it does not erase the qualities that make the communication human.

Keep the decision with the person

The winners will be teams that use AI to remove friction while retaining clear human responsibility. The losers will be those who equate smooth output with effective behavior change.

AI security training should make knowledge easier to access without outsourcing judgment. Watch who reviews the material, who verifies the context and who remains accountable when the system is wrong.

A machine can help someone understand what to do. A human still has to decide what matters.

Key takeaways

• Treat information delivery and behavior change as different objectives in AI-assisted security training.
• Keep people responsible for context, judgment, escalation and final decisions.
• Use AI to reduce friction and improve accessibility, not to replace the human element.
• Evaluate training by safer decisions and meaningful consequences, not polish alone.