Topic starter
27/06/2026 1:59 pm
TL;DR: AI-generated phishing now rivals nation-state quality, and SOC leaders interviewed by Abnormal AI argue that verification, human judgment, culture, and fundamentals still outperform one-time awareness campaigns. The lesson for identity and security teams is that resilient programmes are built around decision quality, not just detection volume.
Editorial analysis by NHI Mgmt Group, based on content published by Abnormal AI: “The SOC Mindset: Cybersecurity Awareness Tips From the Frontline”.
Key questions
Q: How should security teams reduce phishing risk when AI makes scam messages more convincing?
A: Teams should stop relying on obvious spelling mistakes and train people to verify the sender, destination, and request through a separate channel.
Q: Why does annual security awareness training fail against modern phishing?
A: Annual training fails because it usually teaches users to spot outdated email cues, while modern attacks use search ads, trusted domains, social platforms, and legitimate web flows.
Q: What are the signs that a security culture is not supporting verification?
A: Suspicious messages are reported late, users avoid asking for confirmation, and teams treat mistakes as failures instead of learning events.
Practitioner guidance
- Embed verification into high-risk workflows Require secondary confirmation for payment requests, credential resets, vendor changes, and other actions where urgency is commonly abused.
- Measure reporting culture as a control signal Track how quickly users escalate suspicious messages and whether teams feel safe flagging mistakes without blame or delay.
- Separate evidence collection from final decisions Automate log gathering, enrichment, and routing, but keep trust decisions with analysts or approvers who can assess business context.
Bottom line: AI phishing changes the control problem from spotting bad messages to making sound decisions under pressure.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
27/06/2026 3:32 pm
Verification is now an identity control, not just a user habit. AI phishing has erased many of the visual and linguistic shortcuts that awareness programmes used to depend on. That means the real control point moves from recognition to verification at the moment of action, especially for login, payment, and approval requests. The implication is that identity programmes must measure whether people can verify under pressure, not whether they remember a poster.
A few things that frame the scale:
- 71% of NHIs are not rotated within recommended time frames, increasing the risk of compromise over time, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What happens when organisations try to defend against AI-driven phishing with only manual review?
A: Manual review becomes overwhelmed as attack volume rises and the messages themselves become harder to distinguish from legitimate email. Teams end up spending more time triaging and less time preventing impact. In practice, the result is slower response, higher exposure to fraudulent requests, and greater dependence on scarce analysts for work that should be automated.
👉 Read our full editorial: SOC mindset lessons for security teams in the age of AI phishing