AI makes phishing and impersonation nearly indistinguishable from legitimate communication, so organisations can’t rely on employees spotting obvious red flags. The author argues that resilience depends on how well people respond. That takes continuous, role-specific training, clear escalation steps, roles defined before an incident strikes, and response plans tested regularly through realistic simulations.