The Get Cyber Safe Awareness Tracking Survey, the federal research that sits behind Cyber Month, contains a gap worth more attention than it has been getting: 73 percent of Canadians are concerned about AI-related cybercrime, but only 42 percent feel confident they can recognize AI-generated content. Thirty-one points separate worry from capability. Your staff are among those Canadians, and that gap is a training problem rather than a technology problem.
The other numbers, stated carefully
The same research found that 59 percent of online Canadians experienced at least one cyber incident in the past year, most often email scams at 31 percent, text scams at 26 percent, malware at 26 percent and phishing at 26 percent. Separately, 81 percent said they had never had an online scam that cost them money or data, and 25 percent said they feel unprepared for cyber threats.
A note on precision, because it is instructive. The 59 percent describes online Canadians and excludes one category of incident, while the government news release phrases it more broadly as Canadians generally. Both are defensible summaries of the same study, but they are not identical claims, and a statistic that gets rounder each time it is repeated is something to watch for in any security report, including the ones vendors send you.
Why recognition is the wrong thing to train
The instinct, faced with a 42 percent confidence figure, is to teach people to spot AI content. Resist it. Detection advice ages badly: the tells people were taught two years ago, odd hands in images, stilted phrasing, wrong number of fingers, have largely been engineered away. Training your team to be confident AI spotters creates a worse outcome than training them to be uncertain, because confidence is the thing that gets exploited.
The better framing is that it no longer matters whether a message is AI-generated. What matters is whether the request is verified. A cloned voice asking for a payment change and a human voice asking for a payment change get the identical treatment: you hang up and call back on a number you already had. That rule does not degrade as the technology improves, which is the only property worth having in a security habit.
What to actually do
- Make verification procedural, not perceptual. Any request to move money, change bank details or grant access gets confirmed through a second channel you initiated. No exceptions for urgency, seniority or a familiar voice.
- Agree the callback number in advance. Verification only works if the number comes from your records rather than from the message asking to be verified.
- Give people permission to be slow. Most of these attacks work by manufacturing time pressure. State explicitly that nobody will be criticized for delaying a payment to check it.
- Name the scenarios out loud. A voice that sounds like the owner. A video call where a colleague looks slightly off. A text from a supplier with new banking details. Discussed in advance, these become recognizable situations rather than surprises.
- Protect the raw material where it is cheap to do so. Public voice and video of your leadership is useful to an attacker, which is a reason for caution rather than silence.
- Use the free federal material. Get Cyber Safe publishes explainers and staff-ready content for October with no vendor attached, which is rarer than it should be.
The takeaway
The 31-point gap between fear and confidence is not a reason to buy a detection tool. It is a reason to stop depending on detection at all. A business whose rule is that payment and access changes get verified out-of-band is not much affected by how convincing the fake becomes, which is the position you want to be in given that it will keep getting better.