As employees increasingly rely on AI – a trend that makes companies more vulnerable to data breaches – almost half (48%) of those queried in a new national survey reported having never received guidance from their employer on how to use AI safely at work.
The survey – conducted in October among members of the Angus Reid Forum on behalf of ISA Cybersecurity, one of Canada’s leading cyber and AI services and solutions providers – polled 1,042 Canadian office workers about their cybercrime awareness and how they use AI at work.
“Canadian workers have adopted AI faster than their employers can enable and train them to use it safely,” said Andrew Buckles, Executive Vice President, Services, at ISA Cybersecurity.
With the survey showing two in five workers plan to depend more heavily on AI in 2027, Buckles said the training and enablement gap puts companies at risk in two key ways. First, employees can share sensitive information with AI tools their employer doesn’t manage. Second, when employer-provided AI tools aren’t well managed, they can inherit an employee’s access to more data and systems than a task needs, increasing risks associated with AI.
What’s more, 39% of those queried said they use free or personal AI accounts at work. “When an employee pastes confidential client information into a free AI tool, the company loses sight of where that data goes, who can access it, and how long it’s kept,” said Buckles. “Security teams can’t protect data they can’t see.”
“The controls most organizations already have around email security and unapproved apps still work – they just matter even more now,” added Buckles. “The harder problem is the AI tools companies have approved. If an employee can reach more data than their role requires, so can the AI assistant working on their behalf.”
Buckles cautioned that employers must make sure their employees don’t have access to data or systems beyond the scope of their role. He emphasized that while employees have an important part to play, companies carry the main responsibility for managing AI risks. “Maintaining secure operations requires organizations to commit to robust governance across key areas like access control, workflows, usage monitoring, incident detection and response, and AI engineering,” he said.
Other highlights of the survey include:
· Almost half (47%) of respondents use AI tools such as ChatGPT, Claude, Copilot, and Gemini for work at least a few times a week, with a quarter (24%) using them daily.
· Over the last year, 71% of those surveyed moderately or significantly increased their AI use at work.
· Among those who use AI tools at work, respondents most often use AI tools for research and answering questions (59%) and writing or editing emails and documents (56%), while 44% use them to summarize documents, meetings, or research, and roughly 30% to analyze data or spreadsheets, or create presentations, images, or other content.
· In the coming year, 70% of respondents expect the number of AI-enabled scams targeting their workplace to grow, while 59% anticipate their employer will increase its investment in AI security.
· Half of those queried said their employer has a clear policy on how employees can use AI tools, while 18% said the policy exists but is unclear, and 17% stated their employer has no policy at all. Another 15% weren’t sure if their company has an AI policy.
“AI policies and security controls help protect a company and its customers,” said Buckles. “But no single control catches every scam or every mistake, so it’s essential for employees to understand how their actions can affect the organization.” He offered five ways to guard against AI-enabled scams and use AI more safely:
Confirm requests through a trusted channel. If you suspect a message asking for money, data, or account access may be an AI or voice scam, call back on a number you already have. A shared company code word can also help protect against fraud. If “IT” calls asking for a one-time password, hang up and contact your company’s internal help desk yourself.
Think twice before sharing company data. Check your company’s AI policy or ask your employer about which AI tools can handle which data. A tool approved for internal drafts may be off-limits for client information, for example. Never share passwords with any AI tool. Enter only what the task needs and ask when in doubt.
Give AI assistants only needed access. The Canadian Centre for Cyber Security (CCCS) advises against giving AI agents broad or unrestricted access, especially to sensitive data. Turn on only the permissions the task requires and switch them off when you’re done.
Beware of scams embedded in AI summaries. Attackers can hide invisible instructions in an email that make an AI summary show a fake password warning with a phone number to call. Treat any alert, link, or number that appears only in a summary as unverified.
Report quickly, even after a click. Anyone can fall for a well-crafted AI scam. Early reporting limits the damage and makes an honest mistake easier to overcome.
For more information, visit www.isacybersecurity.com.
About ISA Cybersecurity
ISA Cybersecurity is a proudly Canadian cyber and AI services and solutions provider. Trusted by over 500 clients from SMB to global enterprise, they empower organizations to safeguard their most critical assets and adopt AI securely. Through their highly customizable Cyber 360 and AI 360 offerings, they deliver a comprehensive range of governance, assurance, engineering, protection, detection, and response services for the public and private sectors. Backed by over three decades of experience and a vast network of certified experts, they leverage cutting-edge technologies and AI to ensure that clients achieve their privacy and security goals. In addition to Canadian offices in Toronto, Calgary, and Ottawa, and an office in London, England, ISA Cybersecurity operates a world-class, 24/7/365, SOC 2 Type 2 security operations centre in Ontario. They are recognized as a Major Player in both the latest IDC MarketScape: Canadian Security Services Vendor Assessment and the latest IDC MarketScape: Canadian MDR Services Vendor Assessment. Learn more at www.isacybersecurity.com.
About Study Methodology
These are the findings of a study conducted on behalf of ISA Cybersecurity from October 6–12, 2026 among a representative sample of 1,042 working adults (18+) in Canada who are members of the Angus Reid Forum. To qualify for the survey, respondents had to be employed at a company with at least 20 employees and work at a computer as part of their job duties for an average of at least six hours per week. The survey was conducted in all provinces excluding Quebec. For comparison purposes only, a probability sample of this size would carry a margin of error of +/-3.0 percentage points, 19 times out of 20.
Nearly Half of Employees Have Never Received Training on How to Use AI Safely at Work Despite Surge in Use: Survey
