A SANS report cited by TechTarget Cybersecurity found that 19% of organizations run security awareness training designed primarily to meet a specific compliance or audit requirement. In practice, that usually means a long video once or twice a year, a short quiz, and a completion record for the auditor. Employees click through to finish, and the training teaches little about the attacks they will actually face. This analysis draws on reporting from Dark Reading.

Most of these programs were built around a familiar set of warning signs: misspellings, generic greetings, awkward grammar, and links that look slightly off. Generative AI removes most of those signals. Attackers now use AI tools to write fluent, personalized phishing at scale, clone voices, and run convincing video or chat impersonations. Editors from Dark Reading, TechTarget Cybersecurity, and Cybersecurity Dive described a threat landscape changing at a "frenetic pace," with AI used to accelerate and scale both social engineering and supply chain compromises.

The impersonation risk is concrete. The editors pointed to deepfakes aimed at help desks to get multifactor authentication (MFA) reset, and to the widely cited Arup case, in which an employee was on a call with someone presenting as the CFO who asked for a large wire transfer. An employee trained to look for typos has nothing to check on a live call with a familiar face and voice. For your business, this means a payment, an account reset, or a credential handover can be approved by a well-meaning staff member responding to what looks like a routine request.

The same shift affects everyday tool use. Dark Reading's Rob Wright described malicious ads and SEO poisoning (manipulating search results so fake pages rank highly) that push fake AI tool downloads. These pages sit on legitimate platforms such as Cloudflare Pages and OpenAI Custom GPTs, and they install infostealers, malware that collects stored credentials from the infected system. If your staff go looking for new AI tools outside official channels, a single download can hand an attacker working logins to company systems.

Awareness is a security control, and like any control it has to change when the threat changes. This article covers how these AI-enabled attacks work, what they cost organizations, and what specifically needs to change in your awareness program.

How Generative AI Changes Phishing, Voice Cloning and Impersonation Tactics

Deepfakes aimed at the IT help desk to reset multifactor authentication (MFA) were one of the specific threats TechTarget Cybersecurity's editors flagged this Cybersecurity Awareness Month. The technique maps to MITRE ATT&CK T1656 (Impersonation) and T1566.004 (Spearphishing Voice). A cloned voice defeats one of the oldest verification habits staff have, which is recognizing a caller they know. When the reset succeeds, the attacker holds a working account with its existing permissions, so later activity looks like normal use.

Video impersonation extends the same idea to live meetings. The editors pointed to the Arup case, where an employee was on a call with someone presenting as the CFO who asked for a large wire transfer. Many awareness programs teach staff to confirm unusual requests by getting on a call. A convincing deepfake turns that confirmation step into part of the attack, and the loss is a payment that may not be recoverable.

The same tools can copy a colleague's or executive's writing style in a business email compromise (BEC) message. This defeats the "it doesn't sound like them" instinct that experienced employees depend on. AI chatbots can also carry on multi-turn exchanges, answering questions and building rapport over several messages before any request for credentials or money appears. A first message that contains no link or ask gives a reader nothing to flag.

Scale is the other change. The source describes threat actors using AI tools to accelerate, enhance, and scale social engineering and supply chain attacks. Generating many lure variants takes little effort, so filters that match known message text or previously seen samples keep encountering content they have not seen before.

Dark Reading's Rob Wright described how AI-themed lures now arrive through malvertising and SEO poisoning (ATT&CK T1583.008 and T1608.006). Attackers buy sponsored search results and Google ads promoting downloads such as "Claude Code" or other new AI tools. Ad blockers that stop conventional pop-ups do little against ads served inside Facebook and other Meta platforms.

A Gen Digital report found that one out of every three ads on Instagram and Facebook was malicious, pointing to malware, a phishing link, or an outright scam.

Hosting further weakens the "check the domain" rule. An Any.Run report on AI-themed attacks documented heavy use of Cloudflare Pages as infrastructure, and attackers also use OpenAI Custom GPTs. A link on a real provider's domain looks legitimate to someone who has been trained to inspect URLs. A single click can install an infostealer that collects saved credentials (ATT&CK T1555), and Wright noted that developers have been a frequent target. Stolen developer credentials can give an attacker access to source code and build systems, which is how individual infections turn into supply chain incidents.

The same tools create risk from the inside. Wright described the level of shadow AI (employees adopting AI tools outside approved channels) as high enough that people run into malicious links whether they are actively searching or just experimenting. Staff who use unapproved public AI services may also paste customer data, contracts, or internal code into them, which places that information outside your organization's control. Sharon Shea noted that GenAI and agentic AI carry their own inherent security issues. One of these is prompt injection, where instructions hidden in a document, email, or web page cause an AI assistant to take actions or disclose data the user never requested. An assistant connected to your mailbox or file shares can be manipulated through content it reads, even when the employee using it does nothing wrong.

Business Exposure When Employees Cannot Rely on Familiar Warning Signs

A Gen Digital report cited by Dark Reading's Rob Wright found that one out of every three ads on Instagram and Facebook was malicious. Each one pointed to malware, a phishing link, or an outright scam. These ads and sponsored search results sit on platforms your employees use every day, and ad blockers do little to filter them out.

The first business exposure is credential theft. Wright described lures such as "download Claude Code" promoted through Google ads and SEO poisoning (manipulating search rankings so a malicious page appears near the top of results). The pages are hosted on Cloudflare Pages or built as OpenAI Custom GPTs, so the link appears to belong to a real provider. One click can install an infostealer, malware that collects saved passwords, browser session cookies, and access tokens.

If the person who clicks is a developer or a privileged admin, those stolen credentials can open your source code repositories, cloud consoles, and build systems. Credentials taken this way are a common entry point for ransomware and data theft. Because the attacker signs in with valid accounts, the activity is harder to separate from normal work.

The second exposure is fraudulent payments. When an attacker can convincingly impersonate an executive by voice, video, or a well-written email, the approval process itself becomes the point of failure. Your finance staff can follow every step of your payment procedure and still release funds, because the request appears to come from someone with authority to make it. Recovering a completed wire transfer is uncertain, and the loss usually lands on your balance sheet.

The third exposure is data leakage through unsanctioned AI tools. The demand that makes fake AI tool ads effective also drives what Wright called the large amount of shadow AI in organizations. When an employee pastes client records, contracts, or internal code into an unvetted AI service, that data leaves your control. IT often has no record of which service received it.

Each of these paths can trigger obligations you have already accepted. Exposure of personal data may require notice to regulators and affected individuals under data protection law. Many of your client contracts and vendor agreements also carry their own incident reporting duties and security representations. A breach that started with a fake AI download still has to be investigated, reported, and explained to the clients whose data was involved.

Cyber insurance adds another layer of scrutiny. Dark Reading has reported that insurers are split on how to cover damage tied to AI risks. At application or renewal, underwriters may ask how you train staff and how you verify payment and account change requests. Your answers can shape coverage terms and how a later claim is reviewed.

This is where simulated phishing click rates can give leadership a misleading picture. A falling click rate on templated tests shows that employees recognize the templates. It says little about whether a developer would install a fake coding assistant from a sponsored link, or whether a customer-facing employee would act on a convincing caller. AI-generated simulations that personalize lures, an approach one CISO described to TechTarget, make the tests harder. Even so, a single click metric still averages very different roles into one number.

Those roles carry different risks. TechTarget Cybersecurity's Sharon Shea listed the groups that need distinct attention: general employees, C-level executives, privileged admins, HR recruiting staff, customer-facing employees, and third parties and contractors. A report that ties each group's risky behaviors to a specific business consequence, such as a released wire, a stolen admin session, or a leaked client file, gives your board a clearer basis for budget and policy decisions than an organization-wide click rate.

What a Modern Awareness Program Should Include: Immediate, Short-Term and Long-Term Changes

The single most important change you can make this week is a written rule that every payment change, wire request, and credential or MFA reset gets verified out of band. Staff call the requester back on a number already on file in your directory or vendor records, and never use a phone number, email address, or meeting link supplied in the request itself. A cloned voice or synthetic video cannot answer a callback placed to the real person's known phone.

These changes sit in the Preparation phase of the SANS Incident Response Process, and the reporting steps below feed directly into Identification. Three other steps fit into the same week:

• Targeted briefings for finance, HR, executive assistants and help desk staff. Cover what a cloned voice or staged video call can sound and look like, and list the request types that must trigger a callback.
• An AI acceptable-use policy that names approved tools, tells staff to install them only from official app stores or vendor channels, and states what must never be pasted into a prompt (client records, credentials, source code, financial data).
• One-click, blame-free reporting through a report button in the mail client and a named contact for suspicious calls or video requests, with a clear statement that reporting a mistake will not lead to discipline.

Over the next one to three months, replace the annual module with short, frequent sessions built around job roles. Kevin Walker of Black Swan described the approach to TechTarget as short training sprints instead of marathons. The editors listed the groups to build for: general employees, C-level executives, privileged admins, HR and recruiting, customer-facing staff, and third parties and contractors.

For each group, identify the behaviors that create risk and tie each one to a business consequence, such as a misdirected payment or a reset admin account. Set a baseline for each behavior and watch for deviations from it.

Your simulations should match the quality of real lures. One CISO interviewed for the coverage uses AI to generate phishing simulations personalized to individual employees. Extend testing to vishing calls aimed at the help desk and a staged video request from an "executive" asking for an urgent transfer.

Track report rate and time to report as your primary metrics. A fast report from one employee lets your team pull the same message from every other inbox before more people interact with it.

For executive requests, set up a callback procedure or a shared code word agreed in person and never sent by email or chat. Review it whenever an executive or assistant changes roles.

Over the longer term, pair awareness with technical controls that still hold when a person is fooled:

• Phishing-resistant MFA using FIDO2 security keys or passkeys, starting with admin, finance and help desk accounts, so a stolen password or relayed code does not grant access.
• DMARC at enforcement (a policy of quarantine or reject) on your domains, which stops attackers from sending mail that passes as coming from your organization.
• Email filtering that weighs intent and context, such as payment-change language or first-time senders, because well-written text by itself is no longer a useful warning sign.
• Shadow AI governance that reviews DNS, proxy and endpoint logs for unapproved AI tool downloads and sign-ups, paired with a quick process for staff to request a new tool.

Verification only works if people feel comfortable doing it. When an executive publicly thanks an employee who called back to confirm a request, checking becomes routine and stops reading as distrust. Leaders should follow the same callback rules they set for everyone else.

Staffing is part of the long-term plan too. Carnegie Mellon offers a certificate program in AI security aimed at mid-level corporate workers, and Georgia Tech teaches a graduate course in LLM security. Sending one or two of your IT or security staff through a program like this gives you an in-house owner for AI governance and for keeping training content current as attacker techniques change.

Shifting From Spotting Red Flags to Verifying Requests

The core lesson from this year's Cybersecurity Awareness Month coverage is about what you ask employees to judge. A message, call, or video can now look and sound exactly like the person it claims to come from, so appearance no longer tells your staff whether a request is real. What they can still control is how they confirm a request before acting on it.

That changes the purpose of your awareness program. You stop asking people to decide whether something seems fake and start teaching them that certain request types always need confirmation through a separate channel. Those types are moving money, changing payment details, resetting credentials or MFA, and sharing sensitive data. The type of request triggers the check, regardless of how polished, urgent, or familiar the sender appears.

This approach also fits how people actually learn. Kevin Walker of Black Swan told TechTarget that short training sprints work better than hour-long sessions, and a single rule ("verify any money, access, or data request independently") fits easily into a five-minute module. Universities such as Carnegie Mellon and Georgia Tech are building AI security coursework that should produce a more security-minded workforce over the next few years. Your current employees are the ones handling these requests today, so the habit has to come from your own program.

The single most important action is to make out-of-band verification mandatory this week for every financial, credential, and sensitive-data request, and to enforce it the same way for executives as for everyone else. If you are unsure which of your workflows let a request move funds or change access without independent confirmation, a security assessment can trace those approval paths and show where the verification rule should apply first.