Topic starter
19/08/2026 3:56 pm
TL;DR: Generative AI is making social engineering faster, more convincing, and harder to detect, according to Living Security Human Risk Management Platform’s guide, which argues that awareness training alone cannot keep pace with deepfakes, spear phishing, and impersonation at enterprise scale. Measurable behavior change, identity-aware targeting, and continuous reinforcement now matter more than completion rates.
Editorial analysis by NHI Mgmt Group, based on content published by Living Security Human Risk Management Platform: “How to Build Enterprise Social Engineering Security Training”.
Key questions
Q: How should security teams stop AI-powered social engineering from leading to privileged access?
A: Security teams should harden the approval path, not just the inbox.
Q: Why do completion-based awareness programmes fail against deepfake impersonation?
A: Because they measure exposure to training, not resistance to deception.
Q: What are the signs that social engineering training is not reducing real-world risk?
A: A common sign is when users pass phishing tests or complete training but still make risky decisions in live environments.
Practitioner guidance
- Implement risk-based human security targeting Use behaviour, identity, and threat data to identify the users most exposed to phishing, impersonation, and approval fraud, then target those populations first.
- Replace annual training with continuous micro-interventions Deliver short, repeated reinforcement after simulations or risky actions so the lesson is tied to real behaviour rather than a once-a-year completion event.
- Require multi-channel verification for sensitive requests Add out-of-band confirmation for transfers, credential resets, and access approvals when the request arrives through voice, video, or messaging.
Bottom line: Generative AI has made social engineering more convincing, more scalable, and harder for employees to distinguish from legitimate requests.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
19/08/2026 4:34 pm
AI-native impersonation has turned social engineering into a scalable access problem, not just a awareness problem. The article is right to frame deepfakes, spear phishing, and vishing as an enterprise control issue because the attacker no longer needs perfect execution, only believable enough execution at scale. That changes the governance question from "did users complete training?" to "can the organisation consistently interrupt deceptive trust at the point of action?" The practitioner conclusion is that awareness programmes must now be paired with verification and risk-based intervention.
A question worth separating out:
A: Awareness training teaches people how to spot and report threats. Human Risk Management is the wider operating model that predicts risk, guides interventions, and automates routine responses using data from behaviour, identity, and threat intelligence. In practice, HRM turns training into a control system that helps security teams prioritize the highest impact users and situations.
👉 Read our full editorial: AI-driven social engineering is outpacing traditional security training