Securing enterprise communications: Human-centric practices and emerging research

Enterprises face increasingly sophisticated phishing and credential-harvesting campaigns, amplified by the use of generative Artificial Intelligence (AI) to produce context-specific and highly convincing lures. Although employee awareness and training remain necessary, extensive empirical evidence shows that their protective effects are modest, short-lived, and highly dependent on workflow fit. This paper argues that sustainable protection of enterprise communications requires embedding security measures directly into routine work through friction-minimizing, socio-technical alignment.We synthesize recent interdisciplinary findings on human susceptibility, organizational dynamics, and attacker tactics, and we propose a strict, system-enforced, passwordless-first security model. The approach integrates phishing-resistant Multi-Factor Authentication (MFA), device attestation, continuous risk-based verification, and role-specific enablement, supported by measurable Key Performance Indicators (KPIs) and phased implementation gates. By shifting from human-dependent vigilance to deterministic, system-enforced controls, the proposed model substantially reduces credential-based compromise and provides a resilient foundation for enterprise communication security in the era of AI-driven threats.