Topic starter
27/06/2026 1:54 pm
TL;DR: AI-generated phishing is making deceptive messages cleaner, more contextual, and harder for employees to spot, with 98.4% of security leaders saying attackers are already using AI and BEC losses reaching $2.8 billion last year, according to Abnormal AI. Generic annual awareness training is now outpaced by daily-changing lures and role-specific risk.
Editorial analysis by NHI Mgmt Group, based on content published by Abnormal AI: “Training Your Employees to Recognize Malicious AI”.
By the numbers:
- 98.4% of security leaders report AI is already being widely used by attackers against their organizations.
- 40% of organizations had a security incident tied to an avoidable user action in the past year.
Key questions
Q: How should security teams train users when phishing emails are AI-generated?
A: Train users to validate the request, not the writing style.
Q: Why do generic phishing simulations fail against clean, contextual lures?
A: They overfit to outdated tells such as bad grammar, odd formatting, and obvious spelling mistakes.
Q: What are the best practices for phishing awareness in high-risk roles?
A: Segment training by workflow exposure, not by the organisation as a whole.
Practitioner guidance
- Replace annual awareness cycles Move from once-a-year phishing training to continuous reinforcement tied to day-to-day email behaviour, especially for users exposed to vendor, payment, or executive workflows.
- Build role-specific simulations Create simulation tracks that reflect the employee’s actual responsibilities, such as invoice approval, vendor contact, or executive support, so the exercise mirrors real decision pressure.
- Add in-the-moment coaching Trigger immediate coaching when a user opens, replies to, or acts on a suspicious message so the learning happens while the decision is still fresh.
Bottom line: AI-generated phishing reduces the usefulness of old fraud cues, so human judgement now depends on context and timing rather than spotting obvious mistakes.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
27/06/2026 3:26 pm
AI phishing has turned the human verification layer into a contextual judgment problem, not a grammar problem. The old model of awareness training assumed obvious defects would reveal fraud. Generative AI removes those defects, which means human detection now depends on context, timing, and behavioural suspicion instead of surface errors. That shifts the control question from recognition of bad writing to recognition of abnormal intent, and practitioners should treat that as a human identity governance issue.
A question worth separating out:
Q: When does phishing awareness become a governance problem instead of a training problem?
A: When the organisation relies on static content that no longer matches how attacks actually arrive. At that point the issue is not knowledge transfer alone. It is whether identity and security governance can adapt to the pace at which contextual deception changes the human decision surface.
👉 Read our full editorial: AI phishing training must adapt to clean, contextual deception