Topic starter
02/08/2026 11:50 am
TL;DR: AI-powered phishing is making human risk management less about spotting typos and more about resisting adaptive lures, according to Knowbe4. Awareness programmes now have to prove they can reduce successful deception, not just completion rates.
Editorial analysis by NHI Mgmt Group, based on content published by Knowbe4: “Whitepaper AI vs. AI: Combating Cybercriminals with an AI-Powered Human Risk Management Program”.
Key questions
Q: Why does AI make human risk harder to control?
A: AI increases scale, personalisation, and speed.
Q: What do security teams get wrong about phishing awareness training?
A: They often treat training as a replacement for technical containment.
Q: How should security teams train users when phishing emails are AI-generated?
A: Train users to validate the request, not the writing style.
Practitioner guidance
- Strengthen phishing simulations with AI-generated variants Use realistic lures that vary tone, channel, and context so testing reflects how modern campaigns adapt across users and business processes.
- Measure behavioural risk, not just completion rates Track click, report, and credential-entry behaviour by scenario and user group so coaching is based on observed exposure, not training attendance.
- Align training with current attack patterns Refresh SAT content to mirror current AI-assisted phishing themes, especially executive impersonation, internal workflow abuse, and urgent payment or access prompts.
Bottom line: AI-powered phishing shifts the problem from obvious spam to adaptive deception that can be produced and varied at scale.
Glossary terms: Human Risk Management, Phishing Simulation Workflow, Social Engineering
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 3 days ago by NHI Mgmt Group
02/08/2026 1:00 pm
AI-powered phishing is primarily a human trust problem, not just a content-generation problem. The article correctly frames AI as a force multiplier for deception, but the security gap sits in how organisations train, test, and measure trust decisions. That means human risk programmes need to be designed as adaptive controls, not static education. Practitioners should treat the human layer as a managed attack surface, not a compliance exercise.
A question worth separating out:
Q: How can AI improve a human risk management programme without reducing control?
A: AI can help generate timely simulations, personalise examples, and keep training aligned to current attack patterns. Control is preserved when security teams approve content, review targeting rules, and use outcome metrics to verify that the programme is improving decisions rather than just increasing message volume.
👉 Read our full editorial: AI-powered human risk management and the new phishing problem