Welcome to VMblog’s roundup of expert commentary in honor of Internet Safety Month! In this digital age, where connectivity and online activities have become an integral part of our lives, it is crucial to prioritize and enhance our understanding of internet safety. To help you navigate the vast landscape of online security, we heard from some of the industry’s top experts who have dedicated their careers to safeguarding users from potential threats, scams, and privacy breaches. Their valuable perspectives and advice offer a wealth of knowledge to ensure a safer online experience for individuals and families alike.
Internet Safety Month serves as a timely reminder of the importance of proactive measures to protect ourselves and our loved ones in the digital realm. Throughout this roundup, you will find a diverse range of ideas, as these industry experts bring their extensive experience and deep understanding of the evolving cyber landscape, shedding light on emerging threats and offering practical strategies to mitigate risks.
Let this compilation of expert commentary serve as a valuable resource to you. Stay informed, and take proactive steps towards a safer and more secure online experience.
ANNE CUTLER, CYBERSECURITY EXPERT, KEEPER SECURITY
The traditional rules that people learned to spot an online scam no longer apply in the AI era. For years, the advice was straightforward: watch for misspelled emails, awkward phrasing, a gut feeling that something was off. AI has erased those signals entirely. Today, a phishing email can read like it came from your bank, a voice call can sound exactly like your CEO and a deepfake video can put words in someone’s mouth they never said. The cues we relied on are gone, and most people don’t even realize it.
That’s what makes this Internet Safety Month feel different. The conversation can’t stop at “think before you click,” because cybercriminals are now engineering highly convincing, personalized attacks designed to exploit trust at the moment it’s highest. And far too often, what they’re after is the same thing: your credentials.
Usernames and passwords remain the keys to everything people do online, from banking and email to healthcare and work, which is why protecting them is still the most effective defense available. That means using strong, unique passwords for every account and never reusing them across sites, enabling multi-factor authentication wherever it’s offered and using a password manager to make strong credential hygiene sustainable in practice. Where passkeys are supported, they offer an even stronger alternative by eliminating the password entirely. It’s also worth monitoring whether your credentials have been exposed on the dark web, so you can act before attackers do.
AI has made these attacks more convincing than ever. The only meaningful response is to be more deliberate about the fundamentals that protect us.
++
Steve Garrison, SVP, Marketing, Stellar Cyber
Internet Safety Month is for everyone. Whether you’re the representative of a large firm, or a security analyst, or a private individual, you’re vulnerable to attacks, and it’s time to understand that the playbooks that previously governed security protocols are changing faster than ever.
The speed with which you adapt to new AI-powered threats is only one part of the picture. Positioning yourself strategically means that your defenses are flexible, your analysts are trained, and you’re able to respond to rapidly evolving threats without the fear of compromising your information, business, or revenue.
++
Gidi Cohen, CEO and Co-Founder, Bonfy.AI
For years, “internet safety” meant keeping bad actors out: secure the network, harden the endpoint, train employees not to click suspicious links. That mindset made sense when most applications were static and data mostly stayed inside well-defined boundaries. But the way we use the internet has changed faster than our security assumptions. Today, our most sensitive information flows through browsers, SaaS apps, and AI systems in real time, often across organizational lines and into tools we do not fully control. In that world, the real safety question is no longer “Is this device safe?” but “Is this particular piece of data safe to use here, with this person, in this context?”
This shift is colliding with a second one: the rise of AI assistants, agents, and low code automation as default interfaces to the internet. Every time a user connects an AI assistant to a cloud drive, or wires a workflow into email and collaboration tools, they create new pathways for data to move—often in ways traditional controls never anticipated. Security teams are discovering that configuration alone is not enough; they may know which applications and agents exist, but they lack continuous, fine grained control over what specific information those systems can actually see, remember, or send back out. The result is a growing gap between how organizations think their data is being used online and how it is actually being used in practice.
Closing that gap requires treating internet safety as a data decision problem, not just an infrastructure problem. Organizations need three capabilities working together:
- visibility into where their data lives and moves (from email to cloud file stores),
- understanding of that data in business context (who owns it, how sensitive it is, which obligations apply), and
- the ability to enforce policy as information flows between humans, applications, and AI systems in real time.
When those elements are in place, “safety” becomes less about saying no to new tools and more about establishing intelligent guardrails that allow teams to adopt AI and modern cloud services without blindly exposing their customers’ data to the internet. That is the path to a healthier trust boundary online: one where innovation and safety reinforce each other instead of being treated as opposing goals.
++
Chris Camacho, COO and co-founder of Abstract
The internet does not just reach us through our screens anymore. Increasingly, it reaches us through agents acting on our behalf. AI browsers and assistants can read pages, summarize emails, click links, and complete tasks while we look away. That convenience creates a new safety problem: the trusted assistant and the malicious instruction can now meet in the same workflow.
Prompt injection is the clearest example. A few lines of hidden text on a webpage, in an email, or inside content an assistant is asked to summarize can influence what that agent does next. There may be no malware, no traditional phishing click, and no obvious signal to the user. The risk is not just that people make mistakes online. It is that software is now making decisions for them, often with access to the same accounts, data, and permissions.
That is why internet safety in 2026 is a visibility problem before it is a blocking problem. Organizations need to treat AI agents like privileged users, understand what they access, capture the telemetry they generate, and build detections for the moment a trusted tool starts behaving like a threat. Safety is no longer just a wall at the edge. It is knowing, in real time, what is moving through the door you just opened.
++
Dawn-Marie Vaughan, Cybersecurity Global Offering Lead at DXC Technology
Internet security is being misunderstood if it’s still framed as a network problem—it’s an identity and interaction problem. The real risk now lives in the moment a user or machine engages with digital services, where traditional controls have limited visibility into intent or context.
Enterprises that continue to rely on detection-after-the-fact models are already behind. The shift is toward real-time, identity-aware control—security that can continuously interpret behavior, apply deep contextual insight, and intervene instantly to prevent threats before they execute, not just respond after damage is done.
Enterprises must evolve beyond legacy detection + response point solutions and move toward preventative security infrastructure that can enforce dynamic controls at machine-speed. The new generation of internet security will center around automated enforcement of identity-aware controls power by real-time, cross-domain telemetry and continuous authorization.
++
Adam Marrè, CISO, Arctic Wolf
Internet Safety Month is a timely reminder that staying safe online now requires more than spotting suspicious links or avoiding oversharing of personal information. AI has made it significantly easier to create convincing text, images, audio, and video at scale, making false information harder to distinguish from legitimate content. While it’s true this technology helps people work more efficiently–including cybersecurity teams–it can also be used to impersonate trusted individuals, create a false sense of urgency, and spread misinformation before people have time to pause and verify what they’re seeing.
A good example of how quickly this is evolving is what we’re seeing around the 2026 FIFA World Cup. Arctic Wolf researchers tracked more than 10,000 World Cup-themed domains registered since January, many using AI-generated content to make scams look legitimate. The reality is that AI has made deception scalable. Threat actors can now spin up convincing websites, messages, and campaigns in minutes instead of days.
Digital safety is a shared responsibility. People should be encouraged to slow down, think critically about the content in front of them, verify information through trusted sources, and report suspicious messages or posts without fear of blame. Organizations also have a role to play by establishing clear AI-use policies and providing ongoing security awareness training that evolves alongside emerging threats. The goal is not to make people afraid of AI, but to help them use it responsibly and recognize when it is being used to exploit trust.
++
Praveen Jonnala, Global CIO at Vistance Networks
Internet safety is increasingly an identity and access challenge, not just a cybersecurity challenge. As organizations adopt AI agents and connect more users, devices, and applications across their environments, the question becomes less about protecting a perimeter and more about establishing trust at every connection point. The organizations that earn trust will be those that build security directly into the network and the systems people rely on every day, rather than treating it as a control applied after deployment.
++
Mika Aalto, Co-Founder and CEO, Hoxhunt
Humans evolved to recognize dangers in the physical world. We learned to spot predators in the forest, avoid unsafe situations, and rely on our instincts to survive. The internet is different. It’s an environment our brains were never designed for, yet we spend a huge portion of our lives there. That’s why cybersecurity awareness is so important. Most of us ventured into the digital jungle without cyber safety being taught to us in school. We have to deliberately develop the instincts and habits that help us navigate online risks safely.
The challenge is that cybercriminals don’t just prey on ignorance. They prey on many of our best qualities. They exploit our trust, our desire to help others, our curiosity, our ambition, and our sense of urgency. Behind every successful scam is a social engineering technique designed to trigger an emotional response before critical thinking has a chance to catch up. We see heartbreaking examples of this every day, from retirees losing their life savings to confidence scams that began with a single message, to adults manipulated by romance fraud on social media, to teenagers targeted by devastating sextortion campaigns, to employees opening up the gates to multi-million dollar data breaches by a single bad click.
The core motivation to developing strong cyber habits is understanding it’s not just about protecting yourself. It’s about protecting your family, your friends, and your colleagues from very real harm.
The underlying psychology of social engineering hasn’t changed much over the years, but the technology certainly has. Artificial intelligence is allowing attackers to create convincing scams faster, cheaper, and at a scale we’ve never seen before. A scammer can generate realistic emails, clone voices, create deepfake videos, and impersonate trusted organizations with minimal effort. A request that appears to come from your bank, your employer, a government agency, or even a loved one may no longer be what it seems.
The good news is that the most effective defense remains surprisingly simple: Listen to your gut. If something seems off, slow down and verify. Attackers thrive on urgency and emotion. If you receive an unexpected request involving money, credentials, personal information, or sensitive data, verify it through a different communication channel than the one that initiated the request. A quick phone call to a known number or a direct visit to an official website can stop a scam before it starts.
Cybercriminals are also opportunists. They know people let their guard down around emotionally charged events, whether that’s tax season, a natural disaster, or a global sporting event like the World Cup. We routinely see attackers capitalize on these moments with fake ticket sales, spoofed recruitment campaigns, travel scams, fantasy sports schemes, and fraudulent promotions. The safest mindset for Internet Safety Month is not fear, but healthy skepticism. Building good cyber instincts is no different than learning to look both ways before crossing a busy street. A small moment of caution can prevent a lifetime of consequences.
++
Eric Avery, Global Head of Infrastructure and Data, Sumo Logic
Internet safety used to be about who you let onto your network. In 2026, it’s just as much about what you let onto your network. AI agents have become some of the most active participants on the internet, reaching into email, finance, and data on our behalf.
Unlike the people they assist, they don’t get tired, don’t slow down, and don’t think twice before acting. That makes them powerful, and with great power comes required responsibility. The safest organizations are the ones treating an agent the way they’d treat a new employee with system access: scoped, encrypted, company-managed credentials, keys that auto-rotate, and an offboarding plan in place before day one.
The good news is that staying safe doesn’t mean throwing out everything that worked before. Trusted processes that protected us yesterday still protect us today at work and at home. You simply need to evolve them to apply to the technology that has changed.
• Start from “No” with any new AI tool or vendor and make them earn the “Yes… but with x, y, and z conditions.”
• Keep Zero Trust at the center of how AI tooling engages and authenticates.
• Never confuse autonomy with the absence of oversight.
The real question for any AI tool is not whether there’s a human in the loop, but where that human sits. Internet safety in the age of AI ultimately comes down to the same singular denominator it always has: human choice. AI tools are only as safe, and only as expensive, as we let them be.
++
Parag Pathak, VP of Product Marketing at Nasuni
For years, Internet Safety Month has been about keeping bad actors out, with the focus on better tools and a stronger perimeter. That work still matters. But it skips over the harder question every organization should be asking more often: when an attacker does get in, how quickly can we recover? Digital safety is becoming less about prevention alone and more about resilience.
The data suggests most organizations aren’t as ready as they think. In our recent survey of 1,000 enterprise decision-makers, two-thirds (66%) said they were confident in their ability to recover critical unstructured data. Yet only 38% actually have the centrally managed, immutable, or continuously protected systems that make fast recovery possible. That gap shows up when it counts. Last year, 71% were hit by a cyberattack, only 26% were able to recover easily, and 70% took more than a week to get back on track.
A lot of this comes down to fragmentation. Nearly six in ten organizations (58%) rely on four or more separate systems for storage, backup, and recovery, and 79% report inconsistent file access and performance across locations. Every additional system widens the attack surface and slows recovery, and our data shows a clear correlation between the number of vendors an organization juggles and the time it takes to bounce back.
AI raises the stakes further. External data leaks already top the list of file-sharing concerns in our survey at 45%, yet only 30% name shadow AI as a worry, even as employees increasingly turn to AI tools the organization doesn’t control. You can’t protect, govern, or recover what you can’t see, and AI is quietly expanding the number of places sensitive data can end up.
Internet Safety Month is a good reminder that staying safe online isn’t only about stopping attacks. It’s about keeping the business moving when one gets through, and knowing your data stays where it belongs. The organizations that know their data, understand where it lives, and can recover it quickly will be best equipped to handle whatever comes next.
++
Jon Lucas, Director and Co-founder of Hyve Managed Hosting
Internet Safety Month is a timely reminder that while cyber threats continue to evolve, the fundamentals of security remain as important as ever. Whether it’s large-scale bot attacks overwhelming infrastructure, employees experimenting with AI-generated code without proper security review, or attackers exploiting trusted platforms and connected devices, the common thread is that cybercriminals will look for any available weakness. Organizations can’t afford to focus on just one risk area while leaving others exposed.
A layered approach to security is still one of the most effective defenses. Strong access controls, multi-factor authentication, patch management, network monitoring, encryption, vulnerability management, and tested recovery plans all help reduce risk. As attack surfaces expand and threat actors become more creative, resilience comes from assuming that threats can emerge from anywhere and building security into every layer of the environment.
++
Kern Smith, VP – Global Solutions Engineering, Zimperium
As AI becomes embedded in the apps, browsers, and collaboration tools employees use every day, organizations are facing a new challenge: understanding how AI is being accessed and used on mobile devices. For many employees, smartphones have become the most convenient way to interact with AI, whether through dedicated AI applications or AI features embedded within trusted productivity, messaging, and collaboration tools.
This shift creates a significant visibility gap for security teams. Many organizations still have stronger oversight of desktop environments than mobile activity, making it difficult to identify unsanctioned AI use, understand how sensitive information is being shared, or enforce AI governance policies consistently across their workforce.
One of the biggest risks is the unintentional exposure of sensitive data. Employees may use AI tools to summarize documents, generate content, or assist with day-to-day tasks without realizing they are sharing confidential business information, customer data, or intellectual property. The challenge is compounded by the growing number of applications that now include AI capabilities by default, often processing user data behind familiar interfaces.
As organizations update their cybersecurity programs, mobile AI governance should be a key priority. Security teams need visibility into which AI-enabled applications are present on employee devices, how those applications handle data, and whether their use aligns with corporate policies. Ultimately, organizations cannot govern what they cannot see, and as AI adoption accelerates, visibility into mobile AI usage will be critical to protecting corporate data and reducing risk.
##
