Topic starter
23/10/2026 12:48 am
TL;DR: AI-generated phishing, voice cloning and breach reuse are easier to scale in 2026, according to Riot. Identity hygiene, verification habits and leaked-credential monitoring now matter as operational controls, not awareness slogans.
Editorial analysis by NHI Mgmt Group, based on content published by Riot: “Cybersecurity Awareness Month 2026: The Year AI-Driven Attacks Went Mainstream”.
By the numbers:
- The share of French people notified that their personal data was compromised rose from 30% in 2025 to 45% in 2026.
- The US Identity Theft Resource Center tracked over 1,800 reported data compromises in the first half of 2026 alone.
- The first half of 2026 generated 471 million victim notices.
Key questions
Q: Why do reused passwords create such a large identity risk?
A: Reused passwords turn one disclosure into many possible logins.
Q: What are the signs that phishing-resistant controls are not being applied effectively?
A: A common warning sign is that users still authenticate with passwords, SMS codes, or push approvals for sensitive access while rare device registrations and unusual login events are not being reviewed.
A: Security teams should treat phishing and vishing as identity and behavior problems, not just email problems.
Practitioner guidance
- Force side-channel verification for high-risk requests Require call-back or chat-back verification whenever a message requests urgency, payment, credential reset or policy exception.
- Eliminate password reuse exposure Prioritise unique passwords through a password manager, and move critical accounts to passkeys or phishing-resistant MFA wherever possible.
- Monitor leaked identity data continuously Track breach notifications, exposed credentials and suspicious recovery events as part of identity risk management.
Bottom line: AI has made phishing, impersonation and breach reuse cheaper to scale, so the practical control problem is now verification and identity hygiene, not message grammar.
Glossary terms: AI-generated phishing, Voice Cloning, Credential Stuffing, Activation Trust Gap
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
23/10/2026 9:49 am
AI has not replaced classic social engineering, it has industrialised it. The core security change is the collapse of effort required to make deception persuasive, which means phishing is now a scale problem as much as a content problem. That shifts defensive priority from spotting bad writing to verifying intent and origin. For practitioners, the operational question is no longer whether a message looks suspicious, but whether identity can be confirmed out of band.
A question worth separating out:
Q: When should organisations require side-channel verification instead of trusting email or voice?
A: They should require it whenever the request creates financial, access or data-handling risk, especially if the message is urgent, unusual or comes from a channel that attackers commonly spoof. Side-channel checks are most valuable when a single mistaken response could trigger account takeover, fraud or data loss.
👉 Read our full editorial: AI-driven phishing and breach reuse are reshaping cyber risk in 2026
This post was modified 6 days ago by NHI Mgmt Group