Topic starter
19/08/2026 3:54 pm
TL;DR: AI-powered phishing simulation platforms are being used to move beyond static awareness tests by correlating behavior, identity, and threat signals, according to Living Security Human Risk Management Platform. The shift matters because click rates alone do not show who is actually exposed, who has privileged access, or where a human-risk program can reduce real attack likelihood.
Editorial analysis by NHI Mgmt Group, based on content published by Living Security Human Risk Management Platform: “AI-Powered Phishing Simulation Software: How It Works”.
Key questions
Q: How should security teams govern hyper-personalised phishing simulations?
A: They should treat the simulation pipeline as a governed security workflow, not a marketing-style content exercise.
Q: Why do static phishing simulations fail to reduce human-driven incidents?
A: Static simulations fail when they teach generic scenarios that no longer match how attackers operate.
Q: What are the signs that phishing awareness metrics are misleading?
A: Warning signs include low click rates but repeated risky behaviour, no distinction between privileged and low-access users, and training that does not change after new threat patterns emerge.
Practitioner guidance
- Replace static phishing templates with adaptive simulation paths Build scenarios that vary by role, channel, and recent threat patterns so the test reflects how attackers actually target different users.
- Score simulation outcomes with access context Weight clicks, reports, and ignores by privilege level, business criticality, and exposure to targeted threats so a result reflects real risk.
- Feed simulation data into identity and risk workflows Use simulation results to trigger targeted micro-training, manager review, or access scrutiny when high-risk behaviour overlaps with high-value access.
Bottom line: Static phishing templates do not reflect how attackers actually target people, so awareness scores can overstate resilience.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
19/08/2026 4:31 pm
Static awareness is now a weak control model for phishing risk. Organisations that still treat phishing as a periodic test are measuring familiarity with templates, not resistance to real attacker behaviour. The problem is the control itself, not employee attention. A simulation programme that does not evolve with attacker tactics will always lag the threats it is supposed to prepare people for.
A few things that frame the scale:
- Roughly 1 in 3 phishing payloads are delivered outside email, through channels such as social media, search ads and messaging apps.
A question worth separating out:
Q: How do teams turn phishing simulation results into action?
A: Use the results to drive targeted micro-training, manager review, and access-focused intervention for the users whose behaviour creates the greatest risk. The key is to connect simulation outcomes to identity and access processes so the response is specific, not generic, and focused on the accounts that matter most.
👉 Read our full editorial: AI-powered phishing simulations expose the limits of static awareness