Phishing your own people in cybersecurity training? How to protect the brands you use as bait

With widespread use of generative AI, phishing has become an even more formidable threat for organizations. Hyper realistic emails, texts and deepfake voice-notes can be constructed using AI tools, and with better grammar and spelling making threats appear more genuine, AI-powered phishing is causing major concerns.

This year we have seen an escalation in the complexity and variety of phishing methods, with people being targeted on new platforms they trust, beyond the standard email, phone call, or SMS. The concerns have shot to the very top of business. Accenture’s Pulse of Change research found almost half (47%) of C-suite were concerned about the increased risks from cyber attacks and data breaches. Cybersecurity threats posed by deceptive content, such as realistic phishing emails/messages, were seen as the biggest risk.

Attacks may not be simple, but motivations often are: financial gain. Attackers use messages requesting personal information from fraudulent websites to trick their victims to send money or obtain access to their networks. They also know by impersonating senior leaders they can potentially influence people to share data, money, or credentials.

Unfortunately, as phishing attempts become more realistic, employees are more likely to fall victim, which can create serious disruption, financial loss and potential long-term reputational damage for their organization.

Education is key

It is therefore critical that employers provide the necessary education – including training and simulations – to prevent attacks from duping employees into clicking something they…