Topic starter
27/06/2026 2:00 pm
TL;DR: Generative AI is making phishing emails more personalized and grammatically convincing, which weakens traditional red-flag detection and raises the bar for employee awareness training, according to Abnormal AI. Security programmes now need year-round, measurable engagement rather than once-a-year messaging, because human behaviour remains part of the attack surface.
Editorial analysis by NHI Mgmt Group, based on content published by Abnormal AI: “Cybersecurity Awareness Month: How CISOs Can Engage, Educate, and Empower Year-Round”.
Key questions
Q: How should security teams train users when phishing emails are AI-generated?
A: Train users to validate the request, not the writing style.
Q: Why do AI-generated phishing attacks defeat traditional awareness training?
A: They remove the visual clues that old training relied on, such as spelling errors, odd domains, and obviously fake urgency.
Q: What are the best ways to keep security awareness from fading after annual training?
A: Use a year-round programme with repeated, low-friction reinforcement.
Practitioner guidance
- Replace grammar-based phishing cues Train employees to verify sender identity, request context, and destination before acting, because AI-generated messages no longer rely on obvious errors.
- Run awareness on a year-long cadence Use recurring monthly touchpoints, not a single annual campaign, so employees see phishing, policy reminders, and decision practice often enough to retain the behaviour.
- Use interactive training formats Combine quizzes, scavenger hunts, and game-based exercises to force policy recall and make employees work through realistic decisions instead of passively watching videos.
Bottom line: Generative AI is making phishing harder to spot by removing the obvious mistakes that older awareness training depended on.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
27/06/2026 3:33 pm
Generative AI has created an awareness gap, not just a phishing problem: The issue is not simply that more phishing exists, but that the old teaching model assumed attackers would leave visible errors behind. That assumption no longer holds when messages are polished, personalised, and context-aware. Awareness programmes that still depend on obvious tells are training for a threat profile that has already changed. The implication is that human judgement must be governed as an adaptive control, not a static lesson.
A question worth separating out:
Q: Should organisations include personal cyber safety in security awareness programmes?
A: Yes, because personal compromise often spills into work through reused passwords, distracted employees, and social engineering that crosses from home into corporate life. Personal safety guidance improves engagement and reduces the chance that a private incident becomes a workplace access problem.
👉 Read our full editorial: Generative ai phishing and awareness training need a new model