Engagement
AI Security Awareness Culture
Diagnosing and designing the human layer of your AI risk posture.
Published by Crucible Studio
Who this is for
You have the technical controls in place. The policy is written, the tooling is configured, the governance framework is documented. And yet the shadow-AI problem persists. People are still using consumer AI tools with company data, still pasting sensitive information into prompts they shouldn't, still treating AI output as more trustworthy than it deserves to be.
The controls are working. The behaviour isn't. That gap is a culture problem, not a technology problem. And it is the layer your technical controls cannot fix on their own.
This engagement diagnoses where the culture is breaking down, designs the awareness programme that addresses it, and sets it up for delivery with a specialist partner who can run the rollout.
The problem: controls without culture are just documents
Most regulated organisations invest heavily in the technical and governance layers of AI security. They deploy DLP tools, write acceptable-use policies, configure monitoring, and train their risk teams. What they don't invest in is the layer that determines whether any of it works: the actual behaviour of the people using the tools.
The result is a predictable pattern:
- The policy is written but not followed.People don't know what is and isn't acceptable, or they don't care, or they don't see the relevance to their daily work.
- The risk is abstract."Data leakage" and "prompt injection" sound like IT problems, not business problems. People don't change behaviour for risks they can't feel.
- The training is generic.The annual cyber-awareness refresh covers phishing and passwords. It doesn't cover the specific, AI-specific risks that are actually emerging, and it doesn't land because it isn't tailored to the role.
- Leadership isn't visible.If the senior team is using AI tools inconsistently, or not talking about the risks, the message from the top is that this isn't actually a priority.
None of this is fixed by another DLP rule or another policy document. It is fixed by making the risk visible, relevant, and owned, and by building the awareness and norms that make the right behaviour the easy behaviour.
What we do
This is a two-phase engagement we deliver directly, followed by a partnered delivery phase we orchestrate.
1 AI Security Culture Assessment
A diagnostic of how AI is actually being used, what the risk perception looks like, and where the culture is breaking down.
- Current-state usage survey: what employees are actually using, what they think is acceptable, what they don't know, and where the gaps are between policy and practice
- Risk perception audit: do people understand the AI-specific risks (data leakage into foundation models, prompt injection, hallucination as a business risk, output over-trust)? Or do they treat AI as just another tool with no specific risk profile?
- Culture mapping: where the resistance, confusion, or normalisation of risky behaviour is most concentrated. Which teams, which roles, which layers of the organisation are most at risk of being the failure point?
- Leadership visibility assessment: how visible and consistent is the senior team in its own AI use and its messaging about AI risk?
- Output: a culture diagnostic report with a prioritised intervention plan, scoped to the specific risk profile and culture of the organisation
2 AI Security Awareness Programme Design
The design of the awareness and training programme, specific to AI risks and specific to the roles in the organisation. Not a generic cyber-awareness refresh. A programme that makes the AI-specific risk visible, relevant, and actionable.
- Role-based curriculum: developers, data analysts, business users, executives, and third-party vendors each need different depth, different examples, and different risk scenarios. The programme is designed role by role, not one-size-fits-all
- The AI-specific risk curriculum: data handling with foundation models, prompt injection and input risk, output verification and over-trust, shadow-AI and the acceptable alternatives, model-specific risks by use case
- Communication and messaging design: how to make the message land without feeling like "another compliance course nobody watches." The internal narrative, the leadership visibility plan, and the framing that makes the risk feel real and relevant
- Measurement design: how you will know the programme is actually changing behaviour, not just ticking a training box. The metrics, the feedback loops, and the iteration cycle
- Output: the full programme design, ready for delivery, with the measurement framework built in
3 Delivery, Embedding & Culture Change (partnered)
The actual rollout and the ongoing culture work. This phase is delivered with a specialist partner in L&D, change management, or internal communications, who we select and orchestrate. Our role in this phase is oversight, design integrity, and the senior-judgment seat in the room. We don't deliver the training. We make sure it lands, we make sure the message stays consistent, and we make sure the leadership is doing the work.
- Delivery of the training programme: the partner delivers the role-based curriculum to the organisation, with our oversight and design integrity
- The communication campaign: the internal messaging, the leadership visibility plan, and the "why this matters" narrative, executed by the partner with our direction
- Behavioural measurement and iteration: tracking the metrics, identifying where the culture isn't shifting, adjusting the approach. We run the measurement review and the iteration cycle
- Leadership engagement: getting the senior team to be visible, accountable, and consistent in their own AI use, because the culture follows the leadership
- Output: a measured, embedded culture shift, with a sustainable operating rhythm and a defined handoff to the internal team
Why partnered, not solo
The diagnosis and design are our core work, and we do them directly. The delivery and culture-change work is a different skill set: it is change management, internal communications, and learning design, and it is best done by a specialist who does it every day. We partner with a firm or individual who is strong in that space, we select them, we brief them, and we oversee the delivery.
You get the full programme, but you also get our senior judgment in the room throughout, so the design doesn't get lost in the rollout, and the leadership engagement stays on track. The partner does the heavy lifting. We make sure it lands.
Why this, why now
You can have the most sophisticated AI governance framework in the industry, and it will not protect you if the people using the tools don't understand what they're doing. The AI security risk in most regulated organisations is not a technology problem. It is a behaviour problem, and it is the one your technical controls cannot fix on their own.
This engagement is the fix. It makes the risk visible, makes the right behaviour the easy behaviour, and makes the culture work for the governance, not against it.