Topic starter
21/08/2026 4:42 pm
TL;DR: Generative AI has made phishing, vishing, and smishing more convincing and more coordinated, pushing Living Security Human Risk Management Platform’s analysis toward multi-vector simulation, identity-aware risk scoring, and continuous reinforcement rather than annual email-only training. The practical shift is from compliance-led awareness to measurable behavior change across the people and access paths attackers actually exploit.
Editorial analysis by NHI Mgmt Group, based on content published by Living Security Human Risk Management Platform: “Your Guide to Enterprise Phishing Vishing Smishing Training”.
Key questions
A: Security teams should treat phishing as a broader trust problem, not an email problem.
Q: Why do AI-generated phishing campaigns increase risk for privileged users and sensitive workflows?
A: AI phishing increases risk because attackers can scale personalised lures that target the right person at the right moment, including users who can approve payments, reset credentials, or access sensitive systems.
Q: What are the signs that phishing awareness training is not working well enough?
A: Training is failing when employees still click, reply, or escalate suspicious messages without checking basic details first.
Practitioner guidance
- Implement multi-vector simulation programmes Test phishing, vishing and smishing together so users experience the same coordinated pressure attackers use across email, text and voice.
- Correlate awareness results with identity context Combine simulation outcomes with role, access tier and privileged account status so the highest-risk people and workflows are prioritised first.
- Replace annual training with continuous reinforcement Deliver short, just-in-time micro-training immediately after risky actions so the lesson is tied to the actual behavior rather than a later refresher.
Bottom line: Generative AI is making phishing, vishing and smishing harder to distinguish from legitimate contact, which exposes the limits of email-only awareness.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
21/08/2026 5:03 pm
AI-native awareness is becoming a governance requirement, not a training preference. When attackers can generate convincing email, voice and text in the same campaign, the unit of defence is no longer a single message. The control problem shifts to whether the organisation can detect coordinated persuasion across channels and respond before a user action becomes an incident. Practitioners should treat cross-channel simulation as part of operational resilience, not optional training.
A question worth separating out:
Q: Should awareness programmes prioritise email phishing or multi-channel simulation?
A: Multi-channel simulation should take priority because attackers no longer rely on email alone. Email remains important, but campaigns increasingly combine text and voice to reinforce the same pretext. Training that ignores those channels leaves a false boundary around the threat, while broader simulation reflects how employees are actually targeted.
👉 Read our full editorial: AI-native phishing training is replacing email-only awareness models