News

Recent Kaspersky (www.Kaspersky.co.za) research entitled “Cybersecurity in the workplace: Employee knowledge and behaviour” has found that 81,7% of professionals surveyed in the Middle East, Turkiye and Africa (META) region say that they utilise Artificial Intelligence (AI) tools for work tasks. However, only 38% have received training on the cybersecurity aspects of using neural networks, which is one of the critical elements of protection against AI-related risks ranging from data leaks to prompt injections. The research included participants from South Africa, Kenya and Egypt, where the trends were similar to that of the META region.

The vast majority of survey respondents in the META region (94,5%) said that they understand what the term “generative artificial intelligence” means, and for many employees this knowledge is no longer just theoretical: AI tools have become part of their every workday. Overall, 81,7% of respondents use AI tools for work: most often - to write or edit texts (63,2%) and work e-mails (51,5%), to create images or videos with the help of neural networks (45,2%), and for data analytics (50,1%).

The survey uncovered a serious gap in employee preparedness for AI risks. A third (33%) of professionals reported receiving no AI-related training. Among those who had courses, 48% said the focus was on how to effectively use AI tools and create prompts; while only 38% received guidance on the cybersecurity aspect of AI use.

While AI tools, which help automate everyday tasks, are becoming ubiquitous in many organisations, they often remain part of ‘shadow IT', when employees use them without corporate guidance. 72,4% of respondents said generative artificial intelligence tools are permitted at their work, 21,3% acknowledged these tools are not allowed, while 6,3% were unsure.

To make employee use of AI more clear and secure, organisations should implement a company-wide policy regarding this aspect. This policy can prohibit AI use in specific functions and for certain types of data, regulate which AI tools are provided to employees, and allow only tools from the approved list. The policy should be formally documented, and employees should receive proper training. After setting a list of hygiene measures and restrictions, companies should monitor AI usage, identify popular services, and use this information to plan future actions and refine their security measures.

“For successful AI implementation, companies should avoid the extremes of a total ban as well as a free-for-all. Instead, the most effective strategy is a tiered access model, where the level of AI use is calibrated to the data sensitivity of each department. Backed by comprehensive training on cybersecurity aspects of AI, this balanced approach fosters innovation and efficiency while rigorously upholding security standards,” says Chris Norton, General Manager for Sub-Saharan Africa at Kaspersky.

To secure corporate AI use Kaspersky recommends organisations to:

• Train employees on responsible AI usage. Courses on AI security from Kaspersky Automated Security Awareness Platform (http://apo-opa.co/4hsPKwI) can help with adding specialised training to companies' educational programmes.
• Provide IT specialists with relevant knowledge on exploitation techniques and practical defence strategies. The 'Large Language Models Security' training (http://apo-opa.co/4hj7gDn), part of the Kaspersky Cybersecurity Training portfolio, can enhance both the professional development and the overall cybersecurity of an organisation.
• Ensure all employees have a cybersecurity solution installed on all their work and personal devices used to access business data. Kaspersky Next products protect against a range of threats including phishing or installing a fake AI tool, particularly given the growing trend of scammers embedding infostealers in deceptive AI applications.
• Conduct regular surveys to monitor how frequently AI is being used and for which tasks. Using this information, assess both the benefits and risks of AI use to adjust company policy.
• Use a specialised AI proxy that cleans queries on-the-fly by removing specific types of sensitive data (such as names or customer IDs), and uses role-based access control to block inappropriate use cases.
• Create a full-fledged policy that addresses the spectrum of relevant risks. Kaspersky's guidelines for securely implementing AI systems (http://apo-opa.co/4qBNUhh) can be of help.

*The survey was conducted by Toluna research agency at the request of Kaspersky in 2025. The study sample included 2800 online interviews with employees and business owners using computers for work in seven countries: Türkiye, South Africa, Kenya, Pakistan, Egypt, Saudi Arabia, and the UAE.

Distributed by APO Group on behalf of Kaspersky.

For further information please contact:
Nicole Allman
nicole@inkandco.co.za

Social Media:
Facebook: https://apo-opa.co/3KRbnKX
X: https://apo-opa.co/4qBNW8T
YouTube: https://apo-opa.co/3KRbrdF
Instagram: https://apo-opa.co/4qiEuXH
Blog: https://apo-opa.co/3KRbvKr 

About Kaspersky:
Kaspersky is a global cybersecurity and digital privacy company founded in 1997. With over a billion devices protected to date from emerging cyberthreats and targeted attacks, Kaspersky's deep threat intelligence and security expertise is constantly transforming into innovative solutions and services to protect individuals, businesses, critical infrastructure, and governments around the globe. The company's comprehensive security portfolio includes leading digital life protection for personal devices, specialized security products and services for companies, as well as Cyber Immune solutions to fight sophisticated and evolving digital threats. We help millions of individuals and nearly 200,000 corporate clients protect what matters most to them. Learn more at www.Kaspersky.co.za.

Up to 84% of organisations globally practise bring your own device (BYOD) in some form, but only half of them officially allow it, according to a recent report (https://apo-opa.co/498rnlG). While the convenience and cost saving of employees' using their own personal devices for work is undeniable, there are many security risks involved too, particularly in hybrid and remote work environments, asserts Anna Collard from KnowBe4 Africa (www.KnowBe4.com).

It's becoming increasingly common for organisations to expect employees to use their own personal devices for work, such as smartphones, tablets and laptops, and employees seem to prefer the level of freedom it gives them (https://apo-opa.co/3JfJ8Vx). From an organisational perspective, they stand to save an average of R5 000 per employee every year (https://apo-opa.co/47cbQPa) if their employees use just their own mobile devices, with two-thirds reporting that it boosts their productivity (https://apo-opa.co/47wWjL7).

In South Africa, this trend has also become ubiquitous. “BYOD, particularly with smartphones having access to corporate email accounts, has become the norm for a lot of South African organisations for many years already,” asserts Anna Collard, SVP Content Strategy and Evangelist at KnowBe4 Africa.

“While organisations in the financial services sector will have stricter policies, many start-ups, SMEs and even some larger organisations often allow, or even expect, employees to use their own phones and laptops, sometimes without formal policies in place.”

While flexible and convenient, she believes this informal approach introduces significant cyber and compliance risks. The new KnowBe4 Africa Human Risk Management Report 2025 (https://apo-opa.co/3WzbdKR) highlights that up to 80% of employees in Africa use personal devices for work, with broader studies finding 70% of these devices are unmanaged – a critical blind spot for many organisations.

BYOD blind spots

The most notable cybersecurity risk associated with BYOD is data leakage. “Personal devices can easily leak sensitive data through unsecured apps, cloud storage or public Wi-Fi,” she explains. “Without proper controls, even a misplaced phone can become a breach vector (https://apo-opa.co/3Wzbeyp).”

Another security blind spot is employees downloading malicious apps. “Employees may unknowingly install apps that contain malware,” Collard comments. “Some apps mimic legitimate ones (https://apo-opa.co/48zCF2b), but secretly harvest data or open backdoors into corporate systems.” This also extends to "shadow IT" – the use of unapproved applications or services – which can proliferate via personal devices, creating unmonitored entry points for attackers.

A further risk is outdated software. “Personal devices may run outdated operating systems or apps, making them vulnerable to known exploits,” she says. “IT teams often lack visibility to patch non-managed devices, and a large percentage of people have ‘an update is ready to be installed on your device'-notifications that have been hanging around for ages; unactioned.”

In addition, many employees may have a false sense of security about their phone or laptop, especially since almost half of Gen Z respondents (48%) take cybersecurity protection on their personal devices more seriously than on their work devices, according to an Ernst & Young survey in the US (https://apo-opa.co/48FeM9o). “Just because it's my device doesn't mean it's secure for sensitive work data,” stresses Collard. “A weak BYOD policy opens the door to data leaks, shadow IT and insider risk.”

What organisations should do

In order to mitigate these risks, organisations need to come up with a robust BYOD policy. “It starts with policy and awareness (https://apo-opa.co/4ooJBnf),” she states. “Organisations must have a clear, communicated BYOD policy – what's allowed, what's not and what minimum protection is expected.”

Some useful technical controls include employees having strong passwords, multifactor authentication (MFA), encryption, endpoint security and patching. Organisations can also segment their networks to isolate personal devices from critical corporate assets. “Mobile Device Management (MDM) tools can enforce some controls,” concedes Collard, “but they can't replace human vigilance.”

She is a firm advocate of security awareness training to heighten awareness of cybersecurity risks, especially among younger employees who are more likely to use the same passwords for their personal and professional accounts (https://apo-opa.co/48FeM9o). “Organisations need to educate employees on the specific risks of BYOD, beyond  ‘don't click links',” she says. This is crucial, as 96% of organisations believe (https://apo-opa.co/48FeM9o) their employees might fall for more attacks in the future due to AI use by bad actors. The KnowBe4 Africa Human Risk Management Report 2025 (https://apo-opa.co/3WzbdKR) further highlights that AI policy remains a governance blind spot in many organisations, with 46% still developing formal AI policies – making employee education on AI-related BYOD risks even more critical.

“Organisations can simulate attacks (https://apo-opa.co/4oy3AQO) that leverage BYOD vulnerabilities, such as phishing specific to mobile apps, while fostering a culture where employees feel comfortable reporting potential incidents on personal devices without fear of reprisal.”

Alongside security training, Collard is an advocate of digital mindfulness, which she describes as an important  weapon against cybersecurity threats. “Being digitally mindful helps employees slow down, become aware of risky moments and question suspicious behaviour, especially on personal devices,” she says.

Managing the human element

Even though privately-owned devices may appear to be the problem, managing the human element is absolutely key in mitigating BYOD security risks. “A device is just a tool; what matters is how we use it,” Collard emphasises. “You can have the most secure set-up, but if someone is rushed, tired or emotionally triggered, they're more likely to click on a malicious link or fall for a scam.”

She is adamant that organisations need to train their employees' attention and awareness to build resilience, not just rely on tools. “Ultimately, it's a combination of the right technology and human vigilance,” she concludes.

Distributed by APO Group on behalf of KnowBe4.

Contact details:
KnowBe4
Anne Dolinschek
anned@knowbe4.com

Red Ribbon
TJ Coenraad
tayla@redribboncommunications.co.za