Topic starter
20/08/2026 5:42 pm
TL;DR: Generative AI is pushing employee security training toward adaptive, role-specific interventions because static annual modules no longer match AI-enabled attack speed or personalisation, according to the Living Security Human Risk Management Platform. Human-risk programmes need behaviour signals and governance to show whether training is actually reducing exposure.
Editorial analysis by NHI Mgmt Group, based on content published by Living Security Human Risk Management Platform: “7 Tips for Generative AI Cybersecurity Awareness Training”.
Key questions
Q: Why does generative AI make human-risk programmes more effective than awareness campaigns?
A: Because the control objective shifts from informing employees to changing how they behave under pressure.
Q: What are the signs that AI-powered security training is actually working?
A: Look for reduced repeat-risk behaviour, fewer high-risk interactions with phishing or deepfake simulations, and a measurable decline in users who repeatedly need intervention.
Q: What breaks when security training stays static during AI-driven attacks?
A: Static training breaks because generative AI changes the quality, speed, and personalisation of deception faster than annual modules can be refreshed.
Practitioner guidance
- Deploy adaptive phishing and deepfake simulations Use role-specific scenarios that reflect the messages, channels, and authority cues your workforce actually sees, then adjust difficulty based on user responses.
- Measure behaviour-linked risk reduction Track leading indicators such as risky click behaviour, suspicious data sharing, and repeat exposure patterns instead of relying on course completion rates.
- Tie training triggers to identity and threat signals Feed identity, access, endpoint, and threat-intelligence signals into the training workflow so interventions arrive when behaviour indicates elevated risk.
Bottom line: Generative AI is pushing employee security training away from static awareness and toward adaptive interventions that reflect current attack patterns.
Glossary terms: Human Risk Management, Prompt Injection (Agentic), Adaptive Simulation, Deepfake Social Engineering
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
20/08/2026 6:26 pm
Dynamic attack generation has broken the old awareness model. Generative AI reduces the cost of producing convincing phishing, deepfake, and impersonation content, so annual training cycles no longer match the pace of attacker adaptation. The issue is not that employees lack caution. It is that the training environment has been slower to change than the threat environment. Practitioner conclusion: treat training as a continuously updated control, not a once-a-year event.
A few things that frame the scale:
- According to Gartner, worldwide spending on generative AI is set to reach $644 billion in 2025, a nearly 77% year-over-year increase.
A question worth separating out:
Q: How should organisations govern AI usage when employees use unapproved tools?
A: Organisations should start with visibility, not enforcement. If teams cannot see which apps, agents, or workflows are being used, they cannot assess data exposure or apply meaningful controls. Once usage is mapped, policy can shift from blanket bans to context-based decisions that reflect sensitivity, role, and business purpose.
👉 Read our full editorial: Generative AI training should measure behavior, not completions
This post was modified 1 day ago by NHI Mgmt Group