AI-powered phishing is widening the human identity risk gap

At a glance

What this is: KnowBe4’s benchmark report shows phishing is becoming more AI-driven, with a 33.1% baseline susceptibility rate and attacks that increasingly evade standard email defences.

Why it matters: It matters because human identity controls now need to account for adaptive social engineering, not just static awareness training or perimeter filtering.

Context

Phishing remains a human identity problem because attackers target the decision-making layer, not just the mailbox. When scams are generated and tuned by AI, the weakness is no longer only user vigilance but the organisation’s ability to verify intent, recognise deception patterns, and sustain behaviour change over time.

This report is centred on benchmarking susceptibility across large populations, which makes it useful for governance teams but also exposes a structural control gap. In practice, traditional awareness programmes often measure completion rather than resilience, so the real question is whether training changes outcomes fast enough to keep pace with modern phishing campaigns.

Key questions

Q: Why do training completion rates fail as a phishing readiness measure?

A: Because completion measures administration, not resilience. A workforce can finish training and still remain highly vulnerable to realistic fraud, especially when attacks use trusted relationships and normal business context. Readiness should be measured by whether behaviour changes under simulation, not by whether a module was completed.

Q: Why do AI-generated email attacks increase identity risk?

A: AI-generated email attacks increase identity risk because they make malicious requests more convincing at the exact point where people decide whether to trust, approve, or act. The danger is not the email alone but the downstream identity action it triggers, such as credential entry, MFA reset, or privileged approval.

Q: What are the signs that phishing-resistant controls are not being applied effectively?

A: A common warning sign is that users still authenticate with passwords, SMS codes, or push approvals for sensitive access while rare device registrations and unusual login events are not being reviewed. Another indicator is that suspicious requests are handled in the same communication channel as the original message. If controls do not force independent verification and create clear alerting on high-risk events, they are not working as intended.

Q: How should security teams reduce phishing risk without relying only on awareness training?

A: They should combine user training with behavioural detection, vendor verification, and tighter controls on high-risk identity actions. Awareness helps users spot obvious lures, but it does not stop impersonation that looks routine. The stronger model is to detect trust abuse across mail, identity, and workflow layers before approval or credential use occurs.

Technical breakdown

AI-generated phishing and adaptive social engineering

AI changes phishing from a largely templated threat into a high-variation, high-persistence campaign style. Attackers can generate convincing lures at scale, localise wording, and adapt language to role, industry, or current events. That makes pattern-based filtering less reliable because the payload is no longer defined by a small set of repeated tells. The more realistic the message, the more the defender is forced to rely on behavioural scrutiny, user reporting, and layered detection rather than signature-style recognition.

Practical implication: security teams should assume phishing content will be personalised and fast-changing, and tune controls for behavioural resistance rather than message sameness.

Human identity risk and the limits of awareness-only programmes

Human identity risk is the chance that a legitimate employee will be manipulated into taking an unsafe action, such as clicking, replying, approving, or divulging information. Awareness training matters, but completion-based models do not prove that people will resist a live attack. The report’s point is that susceptibility is measurable, which means governance should treat phishing resistance as an operational control with a performance curve, not as a one-time education exercise. That shifts focus from attendance to demonstrated behaviour change.

Practical implication: measure phishing resistance over time and tie awareness programmes to observable reductions in susceptibility, not just training completion rates.

Why native email defences are no longer enough

Native email security controls and secure email gateways still filter obvious malicious content, but AI-written lures can bypass them by avoiding crude indicators and by exploiting trust cues that look normal in context. That does not mean technical controls fail completely, but it does mean their detection boundary has narrowed. When phishing emails become harder to distinguish from legitimate business communication, defenders need a control stack that combines email filtering, user reporting, identity verification steps, and monitored response workflows.

Practical implication: review whether email-only controls are absorbing too much of the detection burden and add identity-aware verification where business risk is highest.

NHI Mgmt Group analysis

AI-driven phishing widens the human identity risk gap. The article shows that phishing is no longer just a content problem inside email. It is a governance problem at the point where a human identity decides whether a request is trustworthy. That makes employee susceptibility a measurable identity-security exposure rather than a soft awareness concern, and organisations should treat it that way.

Phishing susceptibility is a control outcome, not a training completion metric. Benchmarking against 14.5 million users across 62,400 organisations makes the point that susceptibility can be measured and compared at scale. Completion rates and annual refresher modules do not answer the more important question of whether people behave differently when the lure is credible, personalised, and time-sensitive. Practitioners should judge the programme by resistance, reporting, and reduced click-through, not by attendance.

The defensive centre of gravity is shifting from detection-only to trust verification. When 82.6% of phishing emails leverage AI-generated content, the old assumption that malicious messages will be easy to spot breaks down. That does not eliminate email security, but it does mean identity teams must add stronger verification for payments, account changes, delegation requests, and password resets. Human identity controls need to move closer to the decision point.

Continuous security awareness becomes a resilience control, not a culture slogan. The report’s strongest signal is that risk falls materially when training is sustained over time, which means the control is behavioural reinforcement, not a one-off campaign. In NIST CSF terms, this aligns with awareness and access behaviour as part of broader governance and protection outcomes. Practitioners should connect awareness to measurable risk reduction and ongoing policy enforcement.

From our research library:

• Roughly 1 in 3 phishing payloads are delivered outside email, through channels such as social media, search ads and messaging apps.

What this signals

Human identity controls are becoming a measurable security control surface. Organisations can no longer treat phishing resistance as an education metric alone. If employees are the decision point, then verification, reporting, and role-specific training need to be managed like any other security control with observable outcomes.

Adaptive phishing forces identity teams to think beyond email hygiene. The practical shift is toward trust verification at the point of action, especially for payment changes, account recovery, and sensitive delegation requests. In that model, phishing resilience becomes part of identity governance, not just security awareness.

Behavioural reinforcement matters more than annual refreshers. The article’s core signal is that sustained training reduces susceptibility over time, which means security teams should continuously test and recalibrate the programme. Static content will not keep pace with AI-written lures that evolve faster than human memory.

For practitioners

• Run phishing resistance as a measured control Track click-through, report rate, credential submission, and repeat susceptibility by business unit so the programme is judged on behaviour change, not course completion.
• Prioritise high-risk workforce segments Use phishing benchmark data to focus additional controls on sectors and roles with the highest susceptibility, especially where financial or privileged workflows are exposed.
• Add identity verification to high-impact requests Require out-of-band confirmation for payment changes, vendor banking updates, account recovery, and delegation changes so a single email cannot complete the attack path.
• Test whether email controls are still holding Run simulations that include AI-generated language and context-rich lures to validate whether secure email gateways and native defences still catch realistic attacks.

Key takeaways

• AI-generated phishing is increasing the pressure on human identity controls because attackers can now produce more convincing lures at scale.
• The key evidence is a 33.1% industry-wide phishing susceptibility rate, alongside report findings that AI-generated content dominates modern phishing campaigns.
• Organisations need measurable phishing resistance, not just awareness completion, and should add verification steps for high-risk requests.

Key terms

• Phish-prone percentage: Phish-prone percentage measures the share of users who click or otherwise respond incorrectly during simulated phishing tests. It is a behavioural metric that helps security teams baseline susceptibility, target training, and track whether awareness efforts are improving real-world judgment over time.
• Human Identity Risk: The risk created when attackers manipulate people into taking insecure actions, reusing credentials, or trusting fraudulent requests. For human IAM and awareness programmes, it includes both the account holder’s behaviour and the wider work context that shapes that behaviour.
• Security Awareness Training: Security Awareness Training is the practice of teaching people how to recognize and respond to security risks in daily work. It covers phishing, password hygiene, data handling, social engineering, device safety, and reporting procedures. Effective training changes behavior, supports policy compliance, and reduces human error as an attack path.
• Adaptive Phishing Simulation: Adaptive phishing simulation is a training method that changes content, timing, and targeting based on threat intelligence and user context. It is designed to mirror current attack patterns more closely than static templates, making the exercise a better proxy for real-world susceptibility.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, human identity, and secrets management. It helps identity, security, and IAM practitioners connect identity controls to the wider risk that modern phishing creates.