[ITmedia Enterprise] Only 36% of experts can see through AI text The reality of the collapse of the “human firewall”

The report cited "legacy habits" such as passwords handed out on the first day of employment and the friction of daily logins, rather than a lack of employee knowledge.

Security experts have deep knowledge: 31% agree that a hardware-protected passkey attached to a device is the most secure credential. Still, more than half of respondents, 52%, received a username and password when they joined the company. 76% of organizations have siled authentication methods across internal applications, and 45% use usernames and passwords across those systems.

The report argues that a combination of insecure default settings and constant security notifications causes "authentication fatigue." Because people naturally choose the easiest option, it is difficult to change behavior even with excellent training.

Will employee vigilance be applicable to AI?

The report points out that the idea of a "human firewall," in which the vigilance of employees is the key to defense, no longer applies to AI. Over the past year, 70% of respondents said their organization has experienced an increase in phishing. 44% reported that their organization had been the victim of at least one AI-driven attack, and 43% had experienced suspicious video, audio, or phone impersonation targeting executives or customers.

A test conducted by Okta and Yubico asked experts to distinguish between human-written messages and AI-generated messages. Only 36% of participants were able to correctly identify the human message. The report calls for a shift from defenses that rely on employee education to "structural enforcement" that ensures secure authentication at the initial setup stage.

The report states that modernizing authentication architecture will also prepare companies to control AI agents. 91% said verifying the identity of AI agents is essential, and 57% said it was "extremely important." However, the pace of introduction of AI agents is said to be outpacing the development of controls. In the workplace, there is a growing movement to entrust tasks such as daily schedule management (35%) and drafting internal communications (35%) to AI agents. There are generational differences in tolerance, with 68% of Gen Z professionals and 27% of baby boomers saying they would be comfortable trusting an AI agent to handle customer interactions.

However, 91% of respondents wanted to maintain a "human-in-the-loop" system, where AI agents provide approval before performing risky operations such as escalating privileges or performing financial transactions. The report presents an identity framework that protects access in three phases: before login, during login, and after login, based on phishing-resistant authentication such as passkeys. A starting point for reviewing your awareness investments might be to look at what you're handing new employees on their first day.