​Why Every AI Strategy Needs A Workforce Strategy

​Haris Pylarinos is the founder and CEO of Hack The Box, a leading cyber readiness platform for the AI era.

gettyThere is a common misconception in cybersecurity that spending a lot on software and AI makes the problem go away on its own. That’s not true. You can buy a very expensive car, but without a driver’s license, it’s not taking you anywhere on its own. You have to understand how to drive it first. ​

I’m a strong believer that cybersecurity starts with the people, not the tools. AI is a sophisticated piece of tooling, but you need people who understand how to use it, evaluate it and recognize when it’s wrong. Instead, most AI strategies begin with platforms and investments, while the workforce that is expected to use these systems every day gets far less attention.​

The cyber threat landscape has changed completely in recent years. Before AI, criminals would blast a generic phishing email to a thousand people in a company. It’s an obvious scam, but statistically, if you send it to a thousand people, someone will click. Now, with AI, you can craft a thousand different personalized messages for each individual, targeting their specific interests. Those messages can all be created and sent in parallel, and some systems even allow for live chat. Unsurprisingly, the success rate goes up.​

AI has also changed what it means to do the job. A strong penetration tester from the ‘90s would barely recognize their role today. AI can handle many of the trivial tasks now, which means you need to learn to operate at a different scale. Now it’s like having 10 people reporting to you, all running tasks in parallel, while you’re the one collecting data and making decisions. The role has been reinvented, and criminals are already operating on this level.​

I see organizations make two main mistakes. The first is assuming “spend” equals “solved.” Companies invest heavily in AI tools and agents, then configure them once and move on. But is that agent still performing effectively after a month, or a year? Who is checking whether it’s producing false positives or false negatives? If you don’t have someone who can understand both the underlying technology and the kind of techniques a criminal might apply, you’re already behind.​

The second mistake is implementing AI everywhere without a plan. The benefits are obvious, so they apply it across the board without guardrails. They don’t gradually add parts of the organization to it or compare performance against previous workflows. The result is an insecure environment that might also falsely tell you everything is fine.​

Hands-on practice is mandatory. To build competence in any profession, you have to do it over and over. That’s why platforms like Hack The Box are built around keeping humans competent and in the loop, able to apply critical thinking to whatever scenario is put in front of them.​

The deeper concern is what happens when we skip this. The more we rely on AI, the more our reasoning moves toward the system itself and away from us. We see this in daily life: An AI delivers a ready-made answer, no thinking required, just execute. That trains us to act on automated assumptions while we gradually lose our own problem-solving ability.​

We need to exercise our critical thinking skills constantly to stay sharp, just like it’s important to exercise your body to stay in shape. Getting people ready to use new tools, rather than just showing up one day and handing them over, means investing in humans alongside AI, so both can progress together.​

High-profile AI failures are starting to make organizations more cautious about how much control they hand over, and that caution is warranted. But the real shift needs to happen in what we measure. Too many organizations measure AI adoption when they should be measuring capability instead.​

I don’t think AI will rule the world. But I do believe that over-relying on it is a huge mistake that we need to start fixing now. As more and more execution is delegated to AI, human judgment and experience become more important as well. We need to make sure that part of the process stays intact.​

Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?