Topic starter
20/08/2026 5:42 pm
TL;DR: Generative AI is pushing cybersecurity awareness beyond annual compliance modules toward adaptive, role-specific training that can simulate phishing, deepfakes, and prompt injection at scale, according to the Living Security Human Risk Management Platform. The practical shift is from completion metrics to measurable human-risk reduction, because static content and generic simulations no longer match AI-enabled attack velocity.
Editorial analysis by NHI Mgmt Group, based on content published by Living Security Human Risk Management Platform: “7 Tips for Generative AI Cybersecurity Awareness Training”.
Key questions
Q: What breaks when security training stays static during AI-driven attacks?
A: Static training breaks because generative AI changes the quality, speed, and personalisation of deception faster than annual modules can be refreshed.
Q: Why does generative AI make human-risk programmes more effective than awareness campaigns?
A: Because the control objective shifts from informing employees to changing how they behave under pressure.
Q: What are the signs that AI-powered security training is actually working?
A: Look for reduced repeat-risk behaviour, fewer high-risk interactions with phishing or deepfake simulations, and a measurable decline in users who repeatedly need intervention.
Practitioner guidance
- Deploy adaptive phishing and deepfake simulations Use role-specific scenarios that reflect the messages, channels, and authority cues your workforce actually sees, then adjust difficulty based on user responses.
- Measure behaviour-linked risk reduction Track leading indicators such as risky click behaviour, suspicious data sharing, and repeat exposure patterns instead of relying on course completion rates.
- Tie training triggers to identity and threat signals Feed identity, access, endpoint, and threat-intelligence signals into the training workflow so interventions arrive when behaviour indicates elevated risk.
Bottom line: Generative AI is pushing employee security training away from static awareness and toward adaptive interventions that reflect current attack patterns.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
20/08/2026 6:26 pm
Dynamic attack generation has broken the old awareness model. Generative AI reduces the cost of producing convincing phishing, deepfake, and impersonation content, so annual training cycles no longer match the pace of attacker adaptation. The issue is not that employees lack caution. It is that the training environment has been slower to change than the threat environment. Practitioner conclusion: treat training as a continuously updated control, not a once-a-year event.
A few things that frame the scale:
- According to Gartner, worldwide spending on generative AI is set to reach $644 billion in 2025, a nearly 77% year-over-year increase.
A question worth separating out:
Q: How should organisations govern AI usage when employees use unapproved tools?
A: Organisations should start with visibility, not enforcement. If teams cannot see which apps, agents, or workflows are being used, they cannot assess data exposure or apply meaningful controls. Once usage is mapped, policy can shift from blanket bans to context-based decisions that reflect sensitivity, role, and business purpose.
👉 Read our full editorial: Generative AI cybersecurity training is shifting from awareness to risk reduction