Summer staffing gaps are a normal part of business planning. When annual leave peaks across July and August, organisations plan around it with cover arrangements, delegated approvals and agreed handovers. Those plans should also account for the security risks of colleagues taking on sensitive duties they don’t usually handle, writes Andy Fielder, Chief Technology Officer, at the platform MetaCompliance.
In January 2024, a finance employee at Arup’s Hong Kong office made 15 transfers worth around £20m after a video call with people he believed were the company’s UK chief financial officer and several colleagues. Every participant on the call was an AI-generated fake. Arup confirmed none of its internal systems had been compromised, so the attackers got what they wanted purely by convincing one employee. He’d been suspicious of the initial email and asked for a video call to check it was real, doing exactly what most security training tells employees to do, but the attackers were prepared.
If attackers can fool an employee who speaks to these colleagues every week, a colleague covering the role for a fortnight stands even less chance of spotting the same attempt. Attacks like this are becoming more common. Gartner’s 2025 survey found 62 per cent of organisations had experienced a deepfake attack in the previous 12 months, and concern is highest in the UK, where more than half of the CISOs in our latest research named deepfake impersonation as a major threat to their organisation.
Why new and unfamiliar duties raise the risk
Handing over access and responsibilities is straightforward. The harder part is everything the person who normally does the job has picked up along the way. They will have built up a level of familiarity with the suppliers and colleagues they deal with regularly, so are less likely to be fooled by a phishing email or deepfake. A colleague covering for a couple of weeks won’t have had the chance to build up the same familiarity.
The usual response to overcoming employee-driven risks like this is more security awareness training. Our research found that organisations spend an average of 15 per cent of their annual security budget on awareness education, and 79pc deliver training at least once a fortnight. However, despite the investment, 68pc of CISOs still name employees as their biggest cyber risk.
Most CISOs say today’s security training fails because it’s too generic to feel personally relevant. If an employee completed a module in February and picked up a new set of duties last week, the training won’t have covered any of what they’re now doing. What the training says matters, but so does when it reaches people and who it’s aimed at.
Not every handover needs the same scrutiny
The level of scrutiny given to a handover should match the task. Cover for internal tasks or reporting needs little more than a clear escalation route. Cover for payment approvals, payroll, supplier changes or access requests needs more attention, and the colleague picking it up should be treated as a high-risk user for as long as the cover lasts, with guidance reaching them while they’re making the decision. Eighty-three per cent of CISOs believe targeted interventions like this would reduce cyber risk faster than blanket training approaches.
It’s also worth telling employees that they’re allowed to delay a decision. An impersonation attempt becomes much harder to pull off if the employee receiving it can simply wait for the usual approver to come back, because attackers rely on urgency. An employee who’s been asked to keep everything moving may not feel able to wait, particularly if they’ve never been told that it’s an acceptable thing to do.
Every employee is a line of defence
Human risk management treats every employee as part of a business’ defence. A colleague covering an unfamiliar process still needs to notice when a request looks wrong, and they’ll only manage it if thinking about security has become part of their normal working day.
Summer is a useful test of how far an organisation has got with this. When responsibilities move around, security leaders can see how much of their protection was resting on a few experienced people. Employees will only build the habit of questioning an unusual request through continuous, targeted guidance, delivered while they’re doing the work.
Ultimately, seasonal risk is a governance question. Boards approve the cover arrangements, sign off the leave policy and expect business as usual through August and into September. With 78 per cent of CISOs saying C-level colleagues don’t fully understand employee-driven cyber risk, the security implications of those decisions are unlikely to come up in the same meeting. CISOs should take the lesson for the next seasonal period and make the case for human risk as a year-round investment in their people.
