Topic starter
01/08/2026 9:00 pm
TL;DR: A 33.1% industry-wide phishing susceptibility rate and AI-generated attacks evading more traditional defences are highlighted in KnowBe4’s 2025 benchmarking report, based on 14.5 million users, 62,400 organisations and 67.7 million simulated phishing tests. The governance issue is no longer awareness alone, but whether human identity controls can keep pace with adaptive social engineering, with training reducing risk materially over time.
Editorial analysis by NHI Mgmt Group, based on content published by Knowbe4: “2025 Phishing By Industry Benchmarking Report”.
Key questions
Q: Why do training completion rates fail as a phishing readiness measure?
A: Because completion measures administration, not resilience.
Q: Why do AI-generated email attacks increase identity risk?
A: AI-generated email attacks increase identity risk because they make malicious requests more convincing at the exact point where people decide whether to trust, approve, or act.
Q: What are the signs that phishing-resistant controls are not being applied effectively?
A: A common warning sign is that users still authenticate with passwords, SMS codes, or push approvals for sensitive access while rare device registrations and unusual login events are not being reviewed.
Practitioner guidance
- Run phishing resistance as a measured control Track click-through, report rate, credential submission, and repeat susceptibility by business unit so the programme is judged on behaviour change, not course completion.
- Prioritise high-risk workforce segments Use phishing benchmark data to focus additional controls on sectors and roles with the highest susceptibility, especially where financial or privileged workflows are exposed.
- Add identity verification to high-impact requests Require out-of-band confirmation for payment changes, vendor banking updates, account recovery, and delegation changes so a single email cannot complete the attack path.
Bottom line: AI-generated phishing is increasing the pressure on human identity controls because attackers can now produce more convincing lures at scale.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
01/08/2026 9:07 pm
AI-driven phishing widens the human identity risk gap. The article shows that phishing is no longer just a content problem inside email. It is a governance problem at the point where a human identity decides whether a request is trustworthy. That makes employee susceptibility a measurable identity-security exposure rather than a soft awareness concern, and organisations should treat it that way.
A few things that frame the scale:
- Roughly 1 in 3 phishing payloads are delivered outside email, through channels such as social media, search ads and messaging apps.
A question worth separating out:
Q: How should security teams reduce phishing risk without relying only on awareness training?
A: They should combine user training with behavioural detection, vendor verification, and tighter controls on high-risk identity actions. Awareness helps users spot obvious lures, but it does not stop impersonation that looks routine. The stronger model is to detect trust abuse across mail, identity, and workflow layers before approval or credential use occurs.
👉 Read our full editorial: AI-powered phishing is widening the human identity risk gap