Cybersecurity Leadership 2026 in the Age of AI Impersonation

For decades, organizations have focused on strengthening infrastructure against malware, bots, and outdated software vulnerabilities. But today, a far more adaptive and insidious threat has emerged, one that bypasses firewalls and targets human psychology: AI-powered phishing and impersonation attacks.

Unlike traditional social engineering, these attacks are instant, scalable, hyper-personalized, and nearly costless to execute.

The ground has shifted from systems to people. As a result, cybersecurity leadership must evolve – focusing less on stronger tools and more on shaping behavior, culture, and judgment across the organization.

To unpack this transformation, Daniel Pataki, CTO of Kinsta, offers practical insights on navigating AI-driven threats. Drawing from real-world leadership experiences at Kinsta, he explains why psychological safety, awareness without blame, and organization-wide AI literacy have become strategic priorities.

From handling false alarms constructively to preparing teams for AI-generated phishing under high stress, he outlines how leadership behavior directly influences security resilience.

The shifting cybersecurity threat landscape

You’ve said the biggest cybersecurity risk today isn’t outdated software or bots. But it’s an AI impersonation. That’s a major reframing. According to you, what makes AI-powered phishing qualitatively different from the social engineering attacks?

Pataki: Outdated software and bots are still issues we need to address. But there are effective methodologies and plenty of documentation to support them. There are advances on both sides, but they are incremental and build on previous knowledge. Adapting to change is technical in nature, and you can fully control the attack vector targets.

Social engineering has often been the biggest potential hole in a good defense, but it is hard to get right. A successful high-level attack used to require real humans, a larger investment, time, coordination, language skills, and real talent. Today, they can be generated instantly, automated, scaled, and individualized with ease, and the cost has collapsed to near zero. Adapting to this change is psychological/behavioral in nature, and you have minimal control over the attack vector targets (humans) at best.

Company-wide accountability

On this note, you have mentioned that phishing/cybersecurity is no longer a security team problem, but an overall organizational problem. How can leaders build a culture where employees feel safe questioning requests? Especially when they appear to come from authority.

Pataki: The question already shows why dealing with this will be so difficult for many companies! The conversation has immediately shifted from optimal tooling to building a culture, which is very difficult.

At Kinsta, we’ve always been focused on building a culture of safety, critical thinking, support, understanding, and kindness. We believe these are crucial for sustainable business practices in general, in addition to security.

The only way to create a culture like this is through example. Writing down a good set of cultural policies is easy. But I see companies not living up to their own cultural standards all too often. Let me walk you through some examples at Kinsta.

We believe that…

Making mistakes is a natural part of our job. We also believe security is about staying vigilant and speaking up. A false positive is far preferable to inaction in a live situation.

A few years ago, we had a security alert where half our C-Level was woken up in the middle of the night, and it turned out to be a false alarm. The team member who initiated the alert was publicly acknowledged for doing the right thing. And we took the opportunity to ensure everyone saw that the outcome isn’t just tolerated. We actively want folks to be vigilant, even if that means false positives.

In the initial years of the company, one of our highest-level architects accidentally deleted an internal production database, which resulted in half a day of restoring data.

So, instead of shouting at him or initiating a performance review, we ordered him some pizza and asked him what we could do to help.

After the situation was resolved, we then sat down and worked out how to modify workflows to ensure this situation never happens again.

These are just some examples. The underlying trick is to set up a team that is independent, does not fear consequences of honest mistakes, and thus isn’t afraid to speak up.

Once you have that in place, the next task is to ensure everyone (and I do mean everyone) understands the risks. And is prepared for threats and knows what to do when they are faced with one.

Here are some of the methodologies we use to achieve that:

• Annual security training
• Funnel security requests through a dedicated channel
• Utilize SSO and 2FA on every service
• Continuous internal and external auditing processes
• Regular security tabletop and risk assessment exercises
• Internally orchestrated fake phishing campaigns
• Craft realistic fake scenarios.

In a large organization, it is unrealistic for the CEO to ask for permissions, but it may be entirely likely for a Team Lead to ask a team member for API credentials.

Stress: The hidden vulnerability

You’ve described stress as a critical vulnerability. Why do high-pressure moments make organizations especially exposed to AI-enabled attacks? What practical steps can leaders take at this moment?

Pataki: Stress is gasoline to a fire. The chances of mistakes skyrocket. It exposes and exaggerates issues in your corporate culture, it leads to friction between team members, and the list goes on. This is the reason attackers so often try to create urgency. If you have the right culture in place, the effects of this can be minimized. And that’s another good reason to put one in place.

If something creates urgency and bypasses processes, it should automatically raise suspicion. Building this thinking into your security processes will help counter one of the most often used tactics.

In the heat of the moment, there are some practical things you can do:

• Assess how time-sensitive an issue is, and do not make snap decisions or judgment calls if avoidable. In my experience, time-sensitivity is often overestimated.

• Your job as a leader is to take the pressure off. Regardless of the actual level of pressure, do what you can to remove it from the team so they can effectively focus on resolving the issue.

• Depending on the size of the team available at the moment, I’ve found that taking over triage and delegation can be a useful aid and can make or break a high-tension situation

• In healthy, larger organizations, there shouldn’t be technical tasks that only a leader can perform. If this is the case, I recommend finding the tasks that anyone could do and doing those. I might not be able to spot inconsistencies in a Wireshark dump. But I can make coffee for those who can.

• Think about living up to your culture. Staying true to values can be difficult during high stress, but that’s when the team will appreciate it most.

The Dual AI Reality

Many organizations are rapidly adopting AI internally while facing AI-powered threats externally. How should CTOs deal with this dual reality?

Pataki: The best way to deal with this reality is to jump on the bandwagon. I know many folks are AI skeptics, and I empathize with that. But not dealing with the issue will be a detriment to your organization, if it isn’t already. As with any new technology, there is hype and a bubble surrounding it, which adds annoyance. But there is also true utility and advantage to be had.

Your first task as CTO should be to find that utility, even if you don’t see it today. Speak with folks who have found workflow or other gains and find out how you can incorporate them into your own workflows first. Then go outward using concentric circles to your own leadership, the organization under you, and beyond.

On one hand, this will bring you organizational benefits. On the other hand, this is the best way to understand the potential threat AI poses. It will make your organization more literate in AI and adjacent matters.

The myth of ‘smart people won’t fall for it.‘

Why is assuming ‘smart people won’t fall for this’ a liability in modern cybersecurity strategy?

Pataki: The good old “it won’t happen to me” argument. I have two counterarguments to that line of thinking in general, not just in cybersecurity. The number 1 sentence you hear in interviews with folks who have had any unfortunate situation is “I didn’t think it could happen to me”. That should already shed some light on why this is an unproductive stance. But let’s continue and assume you really have only well-trained security experts on your team.

The number one tennis player today is Carlos Alcaraz. You may be surprised that out of all the points he plays, he “only” wins 54.2 percent. He is the absolute best tennis player in the world, and yet he loses almost every second point.

Everyone will fail at some point. You can decrease the likelihood of that happening (with preparation, not with smarts), but it will never be zero.

Finally, this train of thought is exactly what a true threat actor wants to hear. Exploiting hubris is relatively easy.

The security foundations leaders still overlook

What security basics do you still see leaders underestimating or delaying?

Pataki: Security is about the weakest link, not the most secure one. If you have 2FA (Two-Factor Authentication) set up on everything, that’s great. But if all your passwords are “1234,” including your 1Password master password, and you store 2FA in 1Password, you may as well have saved yourself the trouble of 2FA.

Focusing on the super-advanced tech we have nowadays is great. But forgetting that it all starts with simple things like good password practices is something I commonly see. Cover your bases first and then move on to the advanced stuff.

Advice for new-age leaders in 2026

If you had to give new age leaders one piece of advice about cybersecurity in 2026, what would it be?

Pataki: I’m assuming here, but I think new age leaders understand AI by default; they were born into it, so to speak. They will also find other aspects like firewalls, MFA, and Passkeys second nature.

So, to them, I would highlight the difficulty of changing behavior across an entire team, and how that behavior will make or break security efforts.

For leaders skeptical of AI, I understand their misgivings, but I would still invest in AI literacy within your organization. It will provide numerous benefits while enhancing your protection against AI-driven attacks.

Key takeaway

For cybersecurity leadership in 2026, the mandate is unmistakable: build an environment where:

• questioning authority is not discouraged but expected,
• where urgency automatically triggers verification,
• where reporting a false alarm is seen as a responsibility, not a failure; and
• where AI literacy is embedded across every layer of the organization.

Technology will continue to evolve, and so will AI-powered threats. Tools, controls, and automation remain essential, but they are no longer sufficient on their own. Long-term resilience depends on behavioral discipline, a strong security awareness and culture, and a meaningful shift in leadership mindset.

Leaders who combine these rigorous fundamentals with deeply embedded organizational values will be best positioned to stay ahead of the curve.