Is your HR and payroll ready for AI-powered cyberattacks?

From European supermarkets to French blood banks, recent headlines have shown how widely the effects of a cyberattack can be felt. The UK’s National Cyber Security Centre has warned that AI could help attackers find and exploit existing weaknesses faster and at greater scale.

For HR and payroll leaders, that’s a reason to look closely at where employee data is held, who can access it and how it’s shared. Those checks can help you spot gaps, ask better questions of IT and your suppliers, and make the case for investment before an incident forces the issue.

Think about what happens when someone joins your organisation. Their details might start with a recruitment platform, move into your HR and payroll systems, then be shared with a benefits provider. Some of that happens automatically through integrations. Some still rely on someone downloading a file and sending it on.

Each handover is worth checking, especially when it involves home addresses, National Insurance numbers or bank details. A weakness in one system or process can expose employee data and disrupt work elsewhere, with potentially disastrous consequences for your business.

A cloud HR system is not inherently resilient to AI

While moving to a cloud platform is a big resiliency improvement on older on-premises systems, it doesn't make your system impenetrable. Your vendor will be doing their best to maintain the underlying structures, but the way you use the platform has a major impact on its level of vulnerability.

As the system owners and users, HR and payroll teams have a responsibility for areas such as user access, administrator privileges, integration design, data handling, supplier governance and operational continuity. Over time, that access can become outdated and integrations can become poorly documented. These responsibilities that sit with your team may not have seemed like significant concerns before this point, but risks are becoming magnified in the current landscape.

On top of that, a history of customisation and technical workarounds is exactly the kind of tangled web that gives bad actors a potential entry point. A technically secure platform can still sit within a fragile operating environment.

The risk of undervaluing HR systems

When it comes to funding digital transformations or enhancements, people systems often get the short end of the stick. Passed over in favour of other projects and revenue generating teams, HR and payroll systems are often undervalued. But neglecting to invest in these systems can create massive risk. And leadership teams often don't see the damage that can be done when something goes wrong.

If your system has been historically under-supported in the business, this is the perfect time to remind leadership that you work with business-critical data and that your systems are connected across the business.

AI will expose weaknesses in HR systems faster

Those vulnerabilities that come from not keeping systems up to date will become bigger targets. Because of AI, individual bad actors can hack systems faster and with greater ease than before. We're seeing this in everything from groceries to cryptocurrency.

The NCSC says AI-assisted vulnerability discovery is likely to create a race between attackers identifying weaknesses and organisations applying the necessary fixes. It also expects a widening divide between organisations with mature security programmes and those constrained by legacy technology, limited resources and weaker foundations.

Before AI, attacks of this scale would take larger teams or more time. But the reality we face now is that AI is capable of working through gaps in a system far faster than a human could alone. That means you'll need to be extra careful of any potential breaches.

Identity and personal data protection is key

A lot of the time, successful attacks still begin with the classics. These are the familiar methods we're all familiar with, including phishing, compromised credentials, misuse of valid accounts and exploitation of public-facing services.

To prevent these issues, HR and payroll environments need disciplined access management. That includes reviewing privileged accounts, removing leavers promptly, changing access when someone moves role and ensuring that suppliers or implementation partners do not retain access longer than necessary.

These controls aren't particularly exciting, but that is precisely the NCSC’s point: stronger foundations remain one of the most effective defences against both conventional and AI-assisted attacks. We always say something similar – you have to get the basics right first.

Shadow AI is now an HR data-governance issue

Shadow AI is the use of artificial intelligence tools, large language models (LLMs), or AI-powered features by employees or departments without the knowledge, formal approval, or oversight of an organization's IT and security teams.

The NCSC review warns that employees transferring sensitive or proprietary company data to personal devices for use with unauthorised AI tools can cause organisations to lose visibility over how information is handled and who can access it.

For people functions, the risk is clear. Employees should not paste identifiable employee records, payroll extracts, grievance material, performance information, candidate data or workforce reports into unapproved AI tools.

HR needs a practical AI usage model that combines policy, approved tools, training, data classification and clear examples of what information must never be entered into public or personal AI services.

Recovery matters as much as prevention

The NCSC calls on organisations to prepare for disruption, maintain essential services and recover quickly. While preventing a cyber-attack is the ideal scenario, as these AI-powered hackers become more prolific, it may not always be an option. Instead, it will be important to have systems in place to recover well.

You'll need to have recovery plans in place that help you communicate, get back on track and fix any security gaps. True resiliency doesn't come from never being struck, but from the ability to bounce back once you have been.

Payroll continuity needs a specific plan

Payroll's function in the people world is unique. Not only does a payroll system have access to highly sensitive data, but it's also a direct connection to an organisation's finances. That means there needs to be a clear and concise plan for what happens when something goes wrong with the system or data.

Ask yourselves: Who can decide whether payroll should proceed? What validated information is available outside the affected system? How would the organisation communicate with employees? Which suppliers must be involved, and who has their emergency contact details?

For payroll, a generic corporate continuity plan is unlikely to be enough. Teams need a payroll-specific response covering:

• the last safe point at which payroll can be processed
• access to validated payroll and banking information
• manual or alternative processing arrangements
• decision authority if data integrity is uncertain
• communication with employees and senior leaders
• supplier escalation routes
• reconciliation after systems are restored
• secure offline access to essential contacts and procedures
• which systems and suppliers support critical people processes
• where sensitive data is stored and transferred
• who has privileged or third-party access
• whether integrations and customisations are documented and maintained
• how quickly access can be removed or restricted
• what the organisation would do if payroll technology became unavailable
• whether employees understand the rules around using AI with workforce data

And remember, a response plan that exists only within the unavailable system is not a viable response plan. Consider where you will store it, how it will be communicated and who makes the call for enacting it.

The questions you need to be asking

The first step in resolving any vulnerabilities that your organisation might have is to discover what and where they are. To get a picture of what you're working with, these questions are a good starting place. HR, payroll and IT leaders should work together to establish:

These answers can help you get a clearer picture of the level of risk your systems are exposed to at the moment. While there are many more considerations to consider, this can help you understand how quickly you need to act.

The important thing to remember is that there are things you can do. While the threat of AI is very present, swift and thorough action can keep your organisation's data safe. The NCSC’s warning is a call to make better-informed HR system investment decisions and make sure that resilience is designed into the company’s people technology landscape.

Trying to manage this on your own can feel daunting, but help is out there. If you're struggling to understand what de-risking your people tech looks like, book a free consultation with our team. We help organisations understand develop resilient, future-proof HR and payroll tech stacks and can support you with clarity and best-practice advice.