Topic starter
19/08/2026 3:38 pm
TL;DR: Smishing attacks are now bypassing email controls and targeting employees directly on mobile devices, with one report cited in the article saying 76% of businesses were targeted and attack volume rose 328%, according to Living Security Human Risk Management Platform. Human Risk Management only becomes meaningful when simulation data is linked to identity, behavior, and threat context, not just click rates.
Editorial analysis by NHI Mgmt Group, based on content published by Living Security Human Risk Management Platform: “5 Best SMS Phishing Simulation Platforms of 2026”.
Key questions
Q: What do security teams get wrong about phishing simulations?
A: They often measure the wrong attack path.
Q: Why does smishing create more risk for some employees than others?
A: Smishing becomes more dangerous when the targeted user has privileged or business-critical access, because the same click that looks like an awareness issue can become an access problem.
Q: How do you know if a phishing simulation programme is actually working?
A: Do not stop at click rates.
Practitioner guidance
- Run multi-channel phishing simulations Test SMS, email, voice, and QR-code lures so the programme reflects the actual attack mix rather than a single inbox channel.
- Correlate simulation results with identity data Prioritise users who click and also hold privileged or business-critical access, because their exposure has higher operational consequence.
- Replace punitive follow-up with contextual micro-training Use immediate feedback after a failed simulation to explain the lure, reinforce reporting, and avoid creating fear that suppresses future disclosure.
Bottom line: SMS phishing is a governance problem because it bypasses email-centric controls and reaches employees through a channel many programmes still under-test.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
19/08/2026 4:18 pm
Smishing is now an identity-adjacent control problem, not just an awareness problem. The article is right to frame SMS phishing as a gap that email security cannot close on its own. Once the attack moves to mobile, the organisation loses the benefit of its inbox controls and has to rely on people, identity signals, and post-click telemetry. The practitioner conclusion is that mobile-targeted phishing needs to be governed as part of the broader access-risk programme, not left inside annual training.
A few things that frame the scale:
- The IBM/Ponemon 2025 Cost of a Data Breach Report found that phishing-initiated breaches cost an average of $4.8M each.
A question worth separating out:
Q: What should security teams do when smishing is treated as a human risk issue?
A: They should connect simulation output to identity data, threat intelligence, and follow-up training so the programme can prioritise the people and functions that create the most exposure. That makes HRM operational rather than cosmetic. It also lets security leaders target interventions where they will reduce access risk, not just awareness noise.
👉 Read our full editorial: Smishing simulation platforms expose the human risk gap in mobile attacks