Topic starter
02/08/2026 11:50 am
TL;DR: AI is being used by cybercriminals to scale phishing, social engineering, and other attack tactics, and Knowbe4’s whitepaper argues that AI-assisted security awareness training and simulated phishing can help organisations harden the human layer. The deeper issue is that human risk programs now have to contend with faster, more adaptive deception at machine speed.
Editorial analysis by NHI Mgmt Group, based on content published by Knowbe4: “Whitepaper AI vs. AI: Combating Cybercriminals with an AI-Powered Human Risk Management Program”.
Key questions
Q: How should security teams train users when phishing emails are AI-generated?
A: Train users to validate the request, not the writing style.
Q: Why does AI make human risk harder to control?
A: AI increases scale, personalisation, and speed.
Q: What do security teams get wrong about phishing awareness training?
A: They often treat training as a replacement for technical containment.
Practitioner guidance
- Strengthen phishing simulations with AI-generated variants Use realistic lures that vary tone, channel, and context so testing reflects how modern campaigns adapt across users and business processes.
- Measure behavioural risk, not just completion rates Track click, report, and credential-entry behaviour by scenario and user group so coaching is based on observed exposure, not training attendance.
- Align training with current attack patterns Refresh SAT content to mirror current AI-assisted phishing themes, especially executive impersonation, internal workflow abuse, and urgent payment or access prompts.
Bottom line: AI-powered phishing shifts the problem from obvious spam to adaptive deception that can be produced and varied at scale.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:00 pm
AI-powered phishing is primarily a human trust problem, not just a content-generation problem. The article correctly frames AI as a force multiplier for deception, but the security gap sits in how organisations train, test, and measure trust decisions. That means human risk programmes need to be designed as adaptive controls, not static education. Practitioners should treat the human layer as a managed attack surface, not a compliance exercise.
A question worth separating out:
Q: How can AI improve a human risk management programme without reducing control?
A: AI can help generate timely simulations, personalise examples, and keep training aligned to current attack patterns. Control is preserved when security teams approve content, review targeting rules, and use outcome metrics to verify that the programme is improving decisions rather than just increasing message volume.
👉 Read our full editorial: AI-powered human risk management and the new phishing problem