Topic starter
02/08/2026 12:12 pm
TL;DR: AI-crafted phishing, deepfake impersonation, credential theft and MFA bypass are now standard social engineering tools, while IT and SOC teams struggle with alert overload and fragmented visibility, according to Knowbe4’s whitepaper. The core issue is that human-risk controls and incident response still lag attack speed, making identity-centric detection and response essential.
Editorial analysis by NHI Mgmt Group, based on content published by Knowbe4: “The 9 Biggest Email and Social Engineering Challenges Facing IT and SOC – And How to Fight Back”.
Key questions
Q: What breaks when AI phishing is treated as only an email problem?
A: Teams miss the identity layer of the attack.
Q: Why do deepfake impersonations and MFA bypass still work against mature controls?
A: Because they exploit trust, not just login weakness.
Q: What do teams get wrong about measuring human risk programs?
A: Teams often mistake activity for impact.
Practitioner guidance
- Strengthen identity verification for high-risk requests Require separate verification for payment, password reset, mailbox rule changes, and urgent access requests that arrive through email, chat, or voice channels.
- Correlate email and identity telemetry Join suspicious message data with authentication events, session anomalies, and risky user actions so a phishing event becomes an identity investigation, not an inbox ticket.
- Tighten MFA against prompt and token abuse Prioritise phishing-resistant authentication methods and monitor for repeated approvals, unusual token use, and session hijack indicators.
Bottom line: AI-crafted phishing, deepfake impersonation and MFA bypass now work together as a blended social engineering pattern that overwhelms message-only defences.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:15 pm
AI-enabled social engineering is now an identity control problem, not just a messaging problem. The article shows that attackers are using AI-crafted content, deepfake impersonation and MFA bypass together, which collapses the old separation between email filtering, awareness and authentication. The practical conclusion is that identity verification and session trust now sit at the centre of social engineering defence.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should organisations respond when email, identity, and user-risk tools are fragmented?
A: Treat the fragmentation as an operational gap, not a tooling nuisance. Bring phishing telemetry, authentication data, and case management into one response path so analysts can see who was targeted, who acted, and which accounts need immediate restriction. That reduces dwell time and stops duplicate investigations.
👉 Read our full editorial: Email and social engineering now blend AI, deepfakes and MFA bypass