Topic starter
21/10/2026 2:46 pm
TL;DR: AI has made phishing more believable and raised the cost of weak training and weak governance, according to Jamf. Security teams now need continuous testing, governed access, and human verification instead of relying on obvious warning signs.
Editorial analysis by NHI Mgmt Group, based on content published by Jamf: “Cybersecurity awareness month: a practitioner's view”.
Key questions
Q: Why do overly permissive AI agents create governance risk?
A: Overly permissive agents expand the identity blast radius.
Q: What are the signs that an awareness programme is failing?
A: The clearest signs are repeated user interaction with suspicious messages, weak reporting rates, low follow-through on simulations, and recurring incidents that begin with the same social engineering pattern.
Q: How should security teams reduce phishing risk when AI makes scam messages more convincing?
A: Teams should stop relying on obvious spelling mistakes and train people to verify the sender, destination, and request through a separate channel.
Practitioner guidance
- Run continuous phishing simulations Move beyond annual awareness modules and schedule recurring simulations that cover email, SMS, voice, and deepfake-style lures so employees experience evolving attack patterns.
- Classify AI agents as governed access subjects Inventory copilots, coding agents, and other tool-using systems, then define ownership, approval paths, and revocation rules for the access each one receives.
- Tighten approval paths for high-risk actions Require step-up review for data export, code execution, and destructive operations when those requests originate from AI-assisted workflows or unusual user behaviour.
Bottom line: AI has made phishing more believable, which reduces the value of training that depends on obvious warning signs.
Glossary terms: AI Enhanced Phishing, Agentic Access, Security Awareness Programme, Human Risk Management
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 3 days ago by NHI Mgmt Group
21/10/2026 7:00 pm
AI has turned phishing into an identity-verification problem, not just a user-awareness problem. When deepfakes, smishing, and voice calls can convincingly imitate trusted people, training that focuses only on spotting bad grammar or suspicious links will age poorly. Organisations now need stronger human verification steps, higher-friction approvals, and identity-aware reporting paths. The practitioner conclusion is straightforward: treat believable deception as an access-control issue, not only a training issue.
A question worth separating out:
Q: Should organisations govern AI assistants and AI coding tools together?
A: Yes, because both create the same core risk pattern: AI can access sensitive material, transform it, and move it into places that traditional review processes do not control in real time. Treating assistants and coding tools as separate problems usually creates policy gaps, duplicated tooling and inconsistent evidence. A unified control model is easier to defend and audit.
👉 Read our full editorial: AI phishing and agent governance now define cybersecurity practice
This post was modified 3 days ago by NHI Mgmt Group