Topic starter
27/06/2026 2:05 pm
TL;DR: Hyper-personalised phishing simulations now use real, org-specific threats, user context, and human review to make awareness training more relevant while AI tools also sped up delivery of the MVP, according to Abnormal AI. Generic awareness programmes are losing force because the control problem is contextual identity governance, not just content volume.
Editorial analysis by NHI Mgmt Group, based on content published by Abnormal AI: “Abnormal AI Innovation: Engineering Personalized Security Training at GenAI Speed”.
Key questions
Q: How should security teams govern hyper-personalised phishing simulations?
A: They should treat the simulation pipeline as a governed security workflow, not a marketing-style content exercise.
Q: Why do generic phishing training programmes lose effectiveness?
A: Generic programmes fail because they ignore context.
Q: Generative AI Security Risk
A: Generative AI security risk is the chance that a generative model, its prompts, outputs, training data, or integrations will cause harm to systems, data, or people.
Practitioner guidance
- Govern simulation inputs as identity context Limit which identity attributes can be used to personalise phishing training, and require explicit approval for fields such as manager, location, and behavioural history before they influence campaign targeting.
- Require human review before launch Use an internal approval step for every template, test message, and training video so generated content is validated before it reaches recipients.
- Separate training analytics from access decisions Keep awareness data, completion metrics, and susceptibility signals out of entitlement decisions unless there is a formally defined governance model for reuse.
Bottom line: Hyper-personalised phishing training changes awareness from static content delivery into a governed identity-context workflow.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
27/06/2026 3:42 pm
Hyper-personalised awareness is now an identity governance problem, not just a training problem: Once simulations use role, manager, location, and susceptibility history, the training stack starts consuming identity context as an input to security control. That makes campaign governance part of the identity programme, because the same data used for access decisions can now influence behavioural nudges. Practitioners should treat that convergence as a governance boundary, not a convenience feature.
A few things that frame the scale:
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
- Generative AI use specifically increased from 33% in 2023 to 79% in 2025, according to McKinsey’s Global Surveys on the State of AI.
A question worth separating out:
Q: How do teams keep AI-generated training from becoming another unmanaged risk channel?
A: They should combine approval gates, content sanitisation, audit logging, and role-based access control around the workflow. That keeps the training system aligned with security governance rather than letting model output bypass the controls already used for sensitive identity and campaign data.
👉 Read our full editorial: Hyper-personalised phishing training is changing security awareness