Security teams are adopting AI for triage, threat modelling, code review and phishing defence. Most of the conversation is about securing the model. This talk is about the other attack surface: the people using it.

AI is a mirror with two sides. First, it reflects and amplifies us. The way an analyst frames a prompt, the assumption they bring to an alert, the answer they hoped to see: AI hands these back with fluency and confidence, and confirmation bias quietly becomes part of the control. Second, even when we do everything right, AI may not. Models learn from vast amounts of human data and behaviour that was not always right, so their outputs are the most likely answer, not necessarily the one your situation needs.

There is a third problem anyone with a risk background will recognise. Most risk models assume the past predicts the future. AI is now shaping how people search, decide and click, creating behaviours and data that are not yet visible in our historical baselines. That gap is exactly where social engineers operate.

Drawing on behavioural science, and years reviewing risk models as a Bank of England/PRA supervisor, and MindHug's work on digital-security adoption for UK Government and within UKRI's Digital Security by Design programme, this session covers:
- where human bias enters AI-assisted security workflows, before and after the prompt
- why psychological safety decides whether people report an AI mistake or quietly work around it
- practical checks for framing, confirmation bias and bias carry-forward that teams can use straight away

You will leave with a simple review pattern for AI-assisted security decisions, and a sharper sense of which "AI errors" are really human ones.