Topic starter
21/10/2026 2:46 pm
TL;DR: Generative AI has made phishing, voice cloning, and deepfake fraud faster and easier to scale, according to Adaptive Security, while Verizon's 2024 DBIR places the human element in 68% of breaches. The real shift is from periodic awareness training to continuous verification and risk-based human security.
Editorial analysis by NHI Mgmt Group, based on content published by Adaptive Security: “The Hacker News – Cybersecurity 2026: Human Security”.
Key questions
Q: What is the failure mode when organisations rely on voice or face as identity proof?
A: The failure mode is trust in identity signals that attackers can now imitate cheaply and at scale.
Q: Why does AI make social engineering harder to spot?
A: AI lets attackers tailor messages with context, tone, and timing that resemble normal internal communication.
Q: What are the signs that a human risk programme is not working?
A: Common warning signs include repeated phishing clicks, recurring login failures, unsafe handling of credentials or devices, and the same risky behaviour showing up even after training.
Practitioner guidance
- Implement continuous, role-based phishing simulation Use simulations that vary by role, channel, and exposure so users are tested against the lures they are most likely to see in practice.
- Add explicit verification to high-risk requests Require a second proof step for payment, access, and executive-approval workflows where voice or face would otherwise be treated as sufficient.
- Measure human-risk by failure patterns, not completion rates Track who fails which lure types and feed that data into targeted remediation, escalation, and executive exposure monitoring.
Bottom line: AI-assisted social engineering is eroding the reliability of familiar identity cues such as voice and face, which makes implicit trust a weak control.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
21/10/2026 7:00 pm
AI-assisted social engineering is becoming a verification problem, not just a training problem. When cloned voices, deepfakes, and tailored phishing can be produced at scale, the weak point is the organisation's reliance on human recognition as an implicit control. That changes the governance baseline for identity assurance, especially where approval, payments, or privileged requests depend on informal trust. Practitioners should treat verification as a workflow control, not a soft skill.
A question worth separating out:
Q: Should organisations prioritise verification controls over awareness training?
A: They should prioritise both, but verification controls should come first wherever a bad decision creates financial, access, or executive-risk exposure. Awareness helps people notice a lure, but it cannot reliably stop a convincing impersonation on its own. Verification closes the gap when attackers exploit familiar identity cues.
👉 Read our full editorial: AI-powered social engineering is eroding identity trust