Topic starter
27/06/2026 1:48 pm
TL;DR: 83% of security leaders find awareness training ineffective while 99% of organisations still see human-error incidents, according to Abnormal AI, and it argues phishing defence fails when reporting, remediation, and coaching remain separate workflows. The security model needs closed-loop response, because isolated training cannot change behaviour fast enough to reduce risk.
Editorial analysis by NHI Mgmt Group, based on content published by Abnormal AI: “Building a Closed-Loop Phishing Defense with AI Security Mailbox and AI Phishing Coach”.
By the numbers:
- 83% of security leaders report their awareness training is ineffective, according to Abnormal AI.
- 99% of organizations still experience human-error incidents, according to Abnormal AI.
- AI Security Mailbox reduces user-reported email review time by up to 95%, according to Abnormal AI.
Key questions
Q: How should security teams reduce phishing risk without overloading the SOC?
A: Security teams should route user-reported emails into automated classification and remediation, then reserve manual review for genuinely ambiguous or high-risk cases.
Q: Why do phishing awareness programmes fail when they run separately from incident response?
A: They fail because users never see a direct connection between their report, the security team's action and the coaching that follows.
Q: What are the signs that a phishing defence programme is still fragmented?
A: The clearest signs are manual review queues, generic simulations that do not reflect current threats, and executives who cannot tell whether reporting activity reduces risk.
Practitioner guidance
- Map the phishing report flow end to end Document what happens from user report to triage, remediation and coaching so gaps between teams and tools are visible.
- Automate first-pass email classification Route reported messages into a system that can classify malicious, spam, safe or simulation before they reach a manual queue.
- Use confirmed attacks as coaching inputs Feed validated malicious messages into simulation and feedback workflows so employees are trained on the threats they actually encounter.
Bottom line: Phishing programmes weaken when reporting, remediation and coaching are managed as disconnected activities instead of one coordinated control loop.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
27/06/2026 3:16 pm
Closed-loop phishing defence is an operating model problem, not a content problem: organisations do not fail because they lack enough awareness material. They fail because reporting, remediation and coaching are separated into different systems with different owners and different feedback cycles. When those workflows do not exchange context, the organisation measures participation instead of risk reduction. The practitioner conclusion is that phishing defence must be judged by loop closure, not by campaign volume.
A few things that frame the scale:
- The average time to mitigate a leaked secret is 36 hours, highlighting the operational burden of manual remediation processes, according to the 2024 State of Secrets Management Survey.
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to the State of Secrets in AppSec.
A question worth separating out:
Q: Should organisations use generic phishing templates or real attack data for training?
A: Use real attack data whenever possible. Generic templates can support baseline education, but they rarely teach the signals employees need to recognise in live traffic. Confirmed malicious emails make coaching more relevant because they reflect the organisation's actual threat surface, not an invented scenario. That usually improves recall, reporting quality and employee trust in the programme.
👉 Read our full editorial: Closed-loop phishing defense is replacing fragmented awareness workflows