Phishing has become much more effective than it used to be. There was a time when most phishing lures were laughably obvious, littered with misspellings and clumsy messaging that immediately give them away.
For attackers, this meant that phishing was basically a numbers game, similar to a brute force attack – they send out thousands of crudely written fake emails containing a malicious link, and now and again they might trick someone into clicking through and sharing their login credentials.
These days, it’s very different. When a hacker can use generative AI to perfectly mimic the tone and voice of an organization’s chief financial officer and specifically target employees who are authorized to transfer funds, such threats need to be taken much more seriously. It’s time to build a more adaptive security awareness training program that’s delivered at more regular intervals and specifically designed to combat the latest social engineering techniques being used by attackers.
The Rise of AI-Enabled Social Engineering
A recent Gartner survey shows how far social engineering has spread beyond the inbox. Of the 297 senior security leaders surveyed, 79% reported at least one email phishing, spear-phishing or business email compromise incident in the past 12 months. More worryingly, 41% reported at least one incident in which attackers used a deepfake during an audio call with an employee, and 36% saw the same thing happen on video calls.
Generative AI is being weaponized, because it gives attackers a powerful advantage. For starters, AI helps to optimize reconnaissance, so rather than manually searching a company’s employee database on platforms like LinkedIn for promising targets, they can automate this work to quickly generate a hit list of marks. It’s also used to scour a company’s blog posts and social media feeds, hunting for useful context it can leverage to generate more convincing messages.
Perhaps the most potent aspect of AI, from the attacker’s perspective, is its ability to mimic genuine company communications. AI can compose more realistic messages with no awkward phrases or spelling mistakes, and it can even spoof the specific writing tone of a trusted colleague or manager.
One common tactic is to target employees in an organization’s finance department. The attacker might pose as the company’s CFO, asking the employee to make an urgent financial transfer to a vendor’s account. If the employee isn’t on the ball, they could easily transfer thousands of dollars to a hacker-controlled account.
Why Static Security Training Falls Short
The highly convincing nature of today’s phishing campaigns means traditional static training videos simply aren’t up to the job anymore. Legacy security awareness training programs usually involve insisting that employees watch a series of hour-long videos once or twice a year, but the effectiveness of these methods is now being called into question. Gartner itself makes this point, advising CISOs to replace static training with adaptive programs focused on security behavior and culture.
While static training programs are good for ticking compliance checklist boxes, they don’t do much to help employees to actually change their risky behavior. Such videos are often mundane and outdated, failing to reflect the highly sophisticated and targeted nature of today’s phishing threats. Most employees see them as a chore and try to click through them as quickly as possible, which doesn’t bode well for knowledge retention.
In the 1880s, the German psychologist Hermann Ebbinghaus proposed what became known as the forgetting curve, a theory describing how quickly people lose new information when they make no effort to retain or reinforce it. Ebbinghaus based his theory on experiments in which he memorized lists of nonsense syllables and tracked how much of the list he could recall over time. His results suggested that people may forget roughly half of what they learn within an hour, and most of it within a few days, unless they revisit the material.
While there’s no specific data that proves the Ebbinghaus forgetting curve theory in the context of annual security training videos, it seems likely that passive security training falls short. Most uninterested employees are not going to remember the specific details of a sophisticated phishing technique if they’re asked to recall it six months later.
Using AI to Fight AI Threats
Keeping pace with these threats means moving away from once-a-year videos toward a security awareness training program that adapts over time, and AI is what makes that practical at scale.
Attackers already use AI to tailor their lures to specific people, so training needs to be just as targeted. Someone in finance is far more likely to receive a fake vendor invoice with an urgent payment request than a bogus resume, while an HR manager faces the opposite. AI makes it practical to personalize phishing simulations at scale, generating realistic lures that mirror the threats each employee is most likely to encounter in their role. It can also adjust the difficulty over time.
When someone consistently spots basic simulations, the next ones get harder and closer to the polished, context-aware messages real attackers send. When someone falls for one, they get an immediate, short lesson on the specific cues they missed, rather than waiting months for the next compliance session.
The other critical element of modern security awareness training is gamification. The goal is to make training fun rather than dour or even punishing. Some organizations have a habit of naming and shaming employees who click on malicious links or fail security reviews. Very often, though, these tactics can backfire, creating anxiety and causing resentment among workers who are called out for their sloppiness.
When an employee earns rewards and sees their name climbing the leaderboards as they gain new badges and stars, it encourages them to stay on the ball, watching vigilantly for new kinds of phishing threats. It creates a kind of positive feedback loop, which can dramatically improve knowledge retention.
At the same time, training must also be much more frequent. Instead of annual videos, teams should use micro-learning in the shape of regular, bite-sized and interactive modules that only take 30 seconds or so to complete. If the employee spots a simulated phishing attack, they’ll be rewarded for it instantly. It provides a quick dopamine boost that encourages proactive engagement in training, rather than creating fear.
Turning Employees Into Threat Sensors
The end goal of any security awareness training program is to transform employees into a kind of human firewall. By rewarding people for spotting threats, they become more inclined to look out for them and report them.
By training employees to report new attack vectors, security teams get a continuous stream of real-time intelligence on the evolving nature of phishing email threats. This means the Security Operations Center can identify new patterns and enhance the organization’s defenses by automatically blocking malicious emails that leverage the new techniques before they can do any damage.
This approach changes the emphasis of security awareness training. Instead of looking at which employees haven’t yet completed their annual video session, security teams can look at how often and how quickly each individual is reporting suspicious emails and messages.
Gamification is key to this. By rewarding someone who flags a new kind of phishing technique, workforces are transformed into a kind of human threat-detection network.
Final Thoughts
Malicious messaging techniques will become even more convincing in the future as AI technology advances, and organizations cannot hope to combat them with a static snoozefest that’s only viewed once a year. To be effective, the modern security awareness training program must be continuous, engaging and rewarding.
By using highly adaptive and personalized micro-lessons combined with gamification, organizations can sharpen their employees’ intuition so they can act as a much-needed last line of defense.
“
Brian Wang is a Futurist Thought Leader and a popular Science blogger with 1 million readers per month. His blog Nextbigfuture.com is ranked #1 Science News Blog. It covers many disruptive technology and trends including Space, Robotics, Artificial Intelligence, Medicine, Anti-aging Biotechnology, and Nanotechnology.
Known for identifying cutting edge technologies, he is currently a Co-Founder of a startup and fundraiser for high potential early-stage companies. He is the Head of Research for Allocations for deep technology investments and an Angel Investor at Space Angels.
A frequent speaker at corporations, he has been a TEDx speaker, a Singularity University speaker and guest at numerous interviews for radio and podcasts. He is open to public speaking and advising engagements.
