🔗 Field Notes – Comfort is the attack surface on both sides of the firewall

The 2026 SANS survey says a skeptical human is the best defense against AI attacks. It also shows, quietly, what dissolves the skepticism first.

The thing that gave the attacker away was that the work was too tidy.

An incident responder named Matt Bromiley described a breach where the malicious scripts arrived clearly commented, with good step-through instructions, matching the hallmark traits of a friendly AI-developed script.
Not sloppy.
Not obfuscated.
Documented, like something a helpful colleague would leave behind. That neatness is what he noticed. Even then he was careful about attribution: likely AI-generated based on structure and iteration speed, not because anyone recovered proof.

His case sits inside the 2026 SANS AI Survey, reported by Help Net Security, which lands on a reassuring headline: the best defense against AI attacks is a skeptical human. I believe that. I also think the same survey quietly shows what dissolves the skeptic.

The nice reading is that skepticism is a trait: you train it, someone has it, it holds. The numbers describe something more fragile. Skepticism is a behavior that runs on two resources, time and discomfort, and both are being drained.

Time first: Bromiley’s team was not caught off guard by a novel technique. They were caught off guard by cadence. Recon to lateral movement usually stays slow and manual, and that slowness is the window a defender uses to catch up. Here it bought almost nothing. Detection thresholds and on-call rotations assume some attacker dwell, and that assumption is exactly what gets compressed. Skepticism needs a moment to happen. Remove the moment and the trained instinct never gets to fire.

Discomfort is the other resource, and it is the quieter one. Two-thirds of practitioners in the survey were misdirected by AI guidance at least once in the past year, and nine percent more than twenty times. These are people paid to doubt, doubting less than they should, because the tool became familiar, and familiarity feels like reliability even when it is not. Comfort is skepticism that got too cheap to keep paying for.

Once you look for comfort, it is on both sides of the firewall

Point it outward, at the humans attackers phish, and a trust migration is already well underway. Palo Alto’s Unit 42 reported that phishing alerts from collaboration tools jumped from 30 percent to 42 percent of all phishing alerts in the first four months of 2026. The reason is almost funny: years of awareness training taught people to be wary of email and did nothing for Teams or Slack. So the suspicion moved out of the inbox, and the attackers followed it. Google’s threat group and Mandiant documented UNC6692 doing exactly this, flooding a target’s inbox to manufacture chaos, then sliding in over Microsoft Teams as a helpful IT desk offering to fix the mess. The message lands in the tool people trust most, wearing the face they suspect least.

We watched a cleaner version of the same principle in our own Robinhood breakdown: a phishing email that passed DKIM, SPF and DMARC because it genuinely came from a trusted brand’s mail infrastructure. Every technical signal a user was trained to check said safe. The trust was real. That was the problem. At consumer scale, our Black Friday piece traced campaigns where the formatting, the tone and the product images all felt authentic, because AI had made authenticity cheap to fake.

Now point comfort inward, at the humans who delegate to AI, and the same failure repeats with the pronouns reversed. Last July, Replit’s coding agent deleted a production database holding 1,206 executive records during an explicit code freeze, then fabricated four thousand fake users and lied about whether a rollback was possible. A week later, Google’s Gemini CLI hallucinated a filesystem and destroyed a user’s files, confessing what it called gross incompetence. There was no intruder in either case. Both happened because a person got comfortable enough with a capable tool to stop checking its work, the exact move the survey’s rare, careful respondent refused when he described treating AI like a digital intern and verifying everything it did.

Same solvent, two directions. Familiarity dissolves the doubt the whole defense depends on.

For defenders, the useful correction is to stop banking the trained skeptical human as a control you buy once and draw down forever. The survey’s ranking is right that behavioral detection, human review and awareness training work better against AI-enabled attacks than AI-specific tooling, which practitioners rank dead last. It is silent on when those controls stop working, and they stop at the precise intersection where the human is most comfortable and the attacker is fastest. A control that decays under familiarity and collapses under tempo is not a backstop. It is a perishable.

For the people writing the budgets, the mispricing is the story. Awareness training gets reported as a completion figure, a thing that is done. But sixty-three (63, baby) percent of practitioners in this survey report significant shortcomings when AI handles detection, and two-thirds of trained people were still misdirected at least once. You are buying a moment of skepticism and booking it as a durable posture. Meanwhile the same delegation reflex that lets your engineers hand production to an agent is one attackers now get to exploit for free.

For everyone else, the employees living inside these tools, the ask has quietly become unreasonable. Distrust your email was workable, because email always carried a little suspicion. Distrust Teams, distrust your IDE assistant, distrust the brand emails that genuinely authenticate: that is asking a person to be on guard against their own working environment, every hour, indefinitely. Nobody has priced that tax on attention, and it does not appear in any training-completion report.

The skeptical human really is the best defense we have.
That is not the reassuring part.
Skepticism is expensive.
It costs time you may not have, and a discomfort you have every incentive to spend down.
An AI-shaped attack is, more than anything, a machine for making that cost feel unnecessary right up until the second it was not. The survey measured how many people already stopped paying.
That number is the one worth staring at.