Topic starter
19/08/2026 3:56 pm
TL;DR: AI-powered social engineering is harder to spot because generative attacks now arrive faster and look more legitimate, according to Living Security Human Risk Management Platform. Behaviour metrics and identity-aware checks matter more than completion rates for judging real risk.
Editorial analysis by NHI Mgmt Group, based on content published by Living Security Human Risk Management Platform: “How to Build Enterprise Social Engineering Security Training”.
Key questions
Q: Why do completion-based awareness programmes fail against deepfake impersonation?
A: Because they measure exposure to training, not resistance to deception.
Q: What are the signs that social engineering training is not reducing real-world risk?
A: A common sign is when users pass phishing tests or complete training but still make risky decisions in live environments.
Q: How should security teams stop AI-powered social engineering from leading to privileged access?
A: Security teams should harden the approval path, not just the inbox.
Practitioner guidance
- Implement risk-based human security targeting Use behaviour, identity, and threat data to identify the users most exposed to phishing, impersonation, and approval fraud, then target those populations first.
- Replace annual training with continuous micro-interventions Deliver short, repeated reinforcement after simulations or risky actions so the lesson is tied to real behaviour rather than a once-a-year completion event.
- Require multi-channel verification for sensitive requests Add out-of-band confirmation for transfers, credential resets, and access approvals when the request arrives through voice, video, or messaging.
Bottom line: Generative AI has made social engineering more convincing, more scalable, and harder for employees to distinguish from legitimate requests.
Glossary terms: Human Risk Management, AI-powered social engineering, Deepfake-based impersonation, Behavioral Security Metrics
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 days ago by NHI Mgmt Group
19/08/2026 4:34 pm
AI-native impersonation has turned social engineering into a scalable access problem, not just a awareness problem. The article is right to frame deepfakes, spear phishing, and vishing as an enterprise control issue because the attacker no longer needs perfect execution, only believable enough execution at scale. That changes the governance question from "did users complete training?" to "can the organisation consistently interrupt deceptive trust at the point of action?" The practitioner conclusion is that awareness programmes must now be paired with verification and risk-based intervention.
A question worth separating out:
A: Awareness training teaches people how to spot and report threats. Human Risk Management is the wider operating model that predicts risk, guides interventions, and automates routine responses using data from behaviour, identity, and threat intelligence. In practice, HRM turns training into a control system that helps security teams prioritize the highest impact users and situations.
👉 Read our full editorial: AI-driven social engineering is outpacing traditional security training