Cybersecurity has long been a game of cat and mouse. AI is making the mouse trickier to catch.
Attackers are using AI to launch spear-phishing campaigns, deepfake voice calls and hyper-targeted text attacks. These attacks are virtually impossible for humans to detect and can be launched at an unprecedented scale.
That doesn’t mean organizations should give up. It simply means they need a new strategy. Security awareness training is evolving into human risk management, which emphasizes the processes that help thwart social engineering.
Traditional security awareness training is still vital. However, organizations should layer it with human risk management to address AI-driven threats.
How Security Awareness Training Addresses Traditional Threats
For the past decade, security awareness training has focused on teaching users how to spot social engineering. Users learn to hover over email addresses and links to ensure that they really were what they really were what they claimed to be. They learn to look for generic greetings and clunky wording — hallmarks of phishing emails.
Security awareness training platforms generate phishing simulations to help users practice and test their skills. Regular security awareness training cuts baseline phishing click rates from over 33 percent to under 5 percent within a year and lowers overall employee-caused security incidents by up to 72 percent.
The vast majority of social engineering still relies on traditional psychological manipulations. AI makes the text more polished, but otherwise the standard tactics are the norm. Security awareness training remains a valuable weapon in the cybersecurity arsenal.
The Evolution to Human Risk Management
However, that small percentage of AI-driven attacks can wreak havoc. Because an AI-generated message looks legitimate, human risk management shifts the emphasis from appearance to process.
Employees are trained to identify anomalous requests rather than anomalous emails. For example, if an email or voice call requests an urgent wire transfer, human risk management reinforces an unalterable out-of-band verification process.
Modern human risk management tools also use AI to generate highly convincing, multi-channel simulations. Employees are tested with simulated deepfake voice calls from “executives” or AI-personalized chat messages, preparing them for the reality of cross-platform social engineering.
If an attacker scrapes an organization’s public data, they will use AI to scale a highly targeted attack against the most visible personnel. Human risk management monitors this public attack surface alongside internal telemetry. An executive with public-facing data access is automatically given a higher human risk score, placing them into advanced defensive tracks long before an AI-generated attack lands in their inbox.
Using ‘Risk Scores’ for Targeted Training
Security awareness training platforms generate comprehensive “human risk scores” based on how well users perform during simulations. Security teams often find themselves overwhelmed with data but have no way to apply it to real-world behavior.
With human risk management, users are treated not as the weakest link but as a dynamic source of telemetry. Instead of relying on employees to remember what to do, human risk management builds guardrails so they are prompted when it matters.
Human risk management platforms tie into identity infrastructure, data loss prevention tools and cloud storage providers. If an employee repeatedly clicks risky links or mishandles sensitive corporate data, the system automatically elevates their individual risk score and triggers targeted microlearning.
Blasting every employee with the same training creates resentment and fatigue. Strategic risk management targets the users who are genuinely vulnerable, saving time and money for the rest of the organization.
How Verteks Can Help
Verteks helps organizations leverage KnowBe4’s HRM+ platform to move beyond traditional compliance-based security awareness training. HRM+ merges KnowBe4’s training tools with AI-driven email security and behavioral analytics. It features personalized, continuous education modules and automated, in-the-moment guidance when risky behaviors happen.
Contact one of our experts to learn more about HRM+ and how it can help reduce the risk of AI-driven threats.
