Notifications
Clear all
Topic starter
20/08/2026 5:52 pm
TL;DR: Generative AI has made phishing, deepfakes, shadow AI, and prompt-based data leakage harder to spot, and Living Security Human Risk Management Platform argues that annual awareness training no longer matches the speed or precision of these threats. The practical shift is toward continuous, data-driven behaviour change, where identity, access, and threat signals guide targeted interventions before risky actions turn into incidents.
NHIMG editorial — based on content published by Living Security Human Risk Management Platform: Why GenAI Risk Training Is Important? A CISO's Guide
By the numbers:
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys.
- Only 5.7% of organisations have full visibility into their service accounts.
Questions worth separating out
Q: How should organisations adapt security awareness training for generative AI phishing?
A: Security teams should move from static annual training to continuous, behaviour-focused reinforcement.
Q: Why do privileged employees need more AI risk controls than other users?
A: Privileged employees can cause disproportionate damage if they are tricked into sharing data, approving a request, or trusting a synthetic message.
Q: What do security teams get wrong about Shadow AI?
A: They often treat Shadow AI as an approval problem for software, when it is usually also an identity problem.
Practitioner guidance
- Classify and restrict AI tool usage by data sensitivity Define which tools are approved, which data types are prohibited, and which identity groups may use public models for work.
- Add identity context to AI risk scoring Correlate privileged access, recent suspicious behaviour, and current threat activity so that the users most likely to cause damage receive earlier intervention.
- Replace annual awareness with continuous interventions Use just-in-time coaching, simulations, and targeted prompts when users handle risky requests or interact with unapproved AI tools, rather than relying on one yearly course.
What's in the full article
Living Security Human Risk Management Platform's full blog covers the operational detail this post intentionally leaves for the source:
- Behavioural examples of AI-driven phishing, deepfake, and shadow AI training scenarios
- Role-specific guidance for high-access users, managers, and frontline employees
- Program design detail for continuous interventions, measurement, and coaching workflows
- Discussion of human risk management workflows and platform-driven visibility
👉 Read Living Security Human Risk Management Platform's guide to GenAI risk training for CISOs →
GenAI risk training is shifting from awareness to prevention?
Explore further
20/08/2026 6:31 pm
AI-aware training is no longer a behaviour problem alone, it is an identity governance problem. Once attackers can generate convincing lures at machine speed, the control gap shifts from content recognition to access context. High-access employees, service owners, and developers become disproportionately valuable targets because a single mistake can expose systems, secrets, or approval paths. Practitioners should treat AI risk training as part of identity-risk reduction, not as a standalone awareness campaign.
A question worth separating out:
Q: What should organisations do when AI-driven social engineering targets high-access users?
A: Prioritise containment before the user can complete a risky action. Escalate verification, restrict account changes, and alert identity and security teams when a privileged user is receiving unusual AI-generated requests. The response should focus on interruption, confirmation, and reducing the chance of irreversible approval.
👉 Read our full editorial: GenAI risk training is shifting from awareness to prevention
