AI-driven social engineering attacks: Why traditional awareness training is no longer enough
Phishing emails with poor grammar—that’s a thing of the past. By 2026, attackers will be relying on generative AI to produce highly personalized, linguistically flawless attacks on an industrial scale. The World Economic Forum explicitly warns of this in its Global Cybersecurity Outlook 2025. The question is no longer whether, but how, companies will respond.
What has changed: AI as a weapon
Generative AI has dramatically lowered the barriers to high-quality social engineering attacks:
- Highly personalized phishing campaigns: AI analyzes LinkedIn profiles, press releases, and social media posts—and creates tailored messages that appear authentic.
- Deepfake voice scams: Attackers clone the voices of executives to make fraudulent calls. CEO fraud has reached a new level.
- Automated Target Intelligence (OSINT): AI tools scan public sources to identify vulnerabilities and personal details. Attacks are becoming more precise.
- Scalability: What used to take a team to produce for just a few targets can now be generated for thousands in a matter of minutes.
Why traditional awareness training is no longer enough
Many companies conduct security awareness training—designed for a different threat landscape. Training employees to spot phishing based on poor grammar or suspicious links is training for yesterday. AI-generated attacks systematically circumvent these telltale signs.
What Companies Need to Do Now
Technical safeguards
- Email Security with AI-Powered Analysis (Behavioral Analytics)
- Consistently implement DMARC, DKIM, and SPF
- Prioritize phishing-resistant MFA methods (FIDO2/passkeys)
Processes and verification procedures
- Requirement to call back in response to unusual inquiries—even from known senders
- Dual-control principle for payment orders and access changes
Modern Awareness Training
- Attack simulations using AI-generated phishing emails
- Training on Deepfake Detection and Voice Phishing
- Focus on behavioral change, not just knowledge transfer
Axsos can help you adapt your cybersecurity strategy to the new threat landscape. Contact us for a no-obligation analysis.