Topic starter
01/08/2026 9:00 pm
TL;DR: Phishing susceptibility still sits at 33.1% across the industry, according to Knowbe4, with AI-generated lures making modern attacks harder to stop. Human identity controls need to be measured by resistance to realistic simulations, not training completion alone.
Editorial analysis by NHI Mgmt Group, based on content published by Knowbe4: “2025 Phishing By Industry Benchmarking Report”.
Key questions
Q: Why do AI-generated email attacks increase identity risk?
A: AI-generated email attacks increase identity risk because they make malicious requests more convincing at the exact point where people decide whether to trust, approve, or act.
Q: What are the signs that phishing-resistant controls are not being applied effectively?
A: A common warning sign is that users still authenticate with passwords, SMS codes, or push approvals for sensitive access while rare device registrations and unusual login events are not being reviewed.
Q: Why do training completion rates fail as a phishing readiness measure?
A: Because completion measures administration, not resilience.
Practitioner guidance
- Run phishing resistance as a measured control Track click-through, report rate, credential submission, and repeat susceptibility by business unit so the programme is judged on behaviour change, not course completion.
- Prioritise high-risk workforce segments Use phishing benchmark data to focus additional controls on sectors and roles with the highest susceptibility, especially where financial or privileged workflows are exposed.
- Add identity verification to high-impact requests Require out-of-band confirmation for payment changes, vendor banking updates, account recovery, and delegation changes so a single email cannot complete the attack path.
Bottom line: AI-generated phishing is increasing the pressure on human identity controls because attackers can now produce more convincing lures at scale.
Glossary terms: Human Identity Risk, Phish-prone percentage, Security Awareness Training, Adaptive Phishing Simulation
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 10 hours ago by NHI Mgmt Group
01/08/2026 9:07 pm
AI-driven phishing widens the human identity risk gap. The article shows that phishing is no longer just a content problem inside email. It is a governance problem at the point where a human identity decides whether a request is trustworthy. That makes employee susceptibility a measurable identity-security exposure rather than a soft awareness concern, and organisations should treat it that way.
A few things that frame the scale:
- Roughly 1 in 3 phishing payloads are delivered outside email, through channels such as social media, search ads and messaging apps.
A question worth separating out:
Q: How should security teams reduce phishing risk without relying only on awareness training?
A: They should combine user training with behavioural detection, vendor verification, and tighter controls on high-risk identity actions. Awareness helps users spot obvious lures, but it does not stop impersonation that looks routine. The stronger model is to detect trust abuse across mail, identity, and workflow layers before approval or credential use occurs.
👉 Read our full editorial: AI-powered phishing is widening the human identity risk gap