Why Traditional Security Awareness Training Needs to Change

Security awareness training has long focused on helping employees identify suspicious emails. Staff were taught to look for spelling mistakes, poor grammar, unusual requests, and unfamiliar senders. For many years, these indicators provided a practical way to identify phishing attempts before they caused harm.

That approach is becoming less effective.

AI has changed how phishing campaigns are created. Attackers can now generate convincing messages in seconds, producing content that closely resembles legitimate business communication. Emails that once contained obvious warning signs can now appear professional, relevant, and tailored to their intended recipient.

As phishing techniques evolve, security awareness programmes need to evolve with them.

Modern attacks often avoid these weaknesses altogether.

AI tools can generate well-written content that mirrors the tone and structure of genuine business communications. An attacker no longer needs strong language skills or detailed knowledge of a target organisation to produce a believable message.

This creates a gap between what employees are trained to recognise and the threats they are likely to encounter in practice.

Phishing campaigns traditionally required a balance between quality and scale. Attackers could create highly personalised messages, though this often involved significant research and preparation.

AI reduces that effort dramatically.

Threat actors can analyse publicly available information and generate tailored messages at scale. A campaign can reference an employee's role, current projects, supplier relationships, or organisational structure without requiring extensive manual work.

This allows attackers to increase both volume and relevance at the same time.

The result is a more convincing phishing attempt that feels authentic to the recipient.

Despite advances in technology, phishing continues to rely on influencing behaviour.

Attackers want employees to take action. That action may involve clicking a link, approving a payment, sharing information, or providing credentials.

AI strengthens social engineering by helping attackers create messages that exploit trust and urgency more effectively. Requests may appear to come from senior leadership, trusted suppliers, or existing customers.

Employees who expect phishing emails to look suspicious may be less prepared for communications that appear completely normal.

This shifts the challenge away from spotting obvious signs of fraud and towards making informed decisions under pressure.

Many organisations train staff to identify suspicious emails. A more effective approach is to teach employees how to verify requests.

This distinction matters.

A message may appear legitimate while still being fraudulent. Rather than relying on visual indicators alone, employees should be encouraged to confirm unusual requests through established processes.

Examples include:

• Verifying payment requests through a separate communication channel
• Confirming changes to banking details directly with suppliers
• Checking requests for sensitive information with the appropriate manager
• Validating unexpected access requests before approval

These habits reduce reliance on judgement alone and introduce practical safeguards against deception.

Awareness programmes are most effective when they reflect real-world scenarios.

Employees benefit from seeing examples that resemble the communications they encounter every day. Training should include modern phishing techniques rather than relying solely on outdated examples.

Simulated phishing exercises can also provide valuable insight. They help organisations understand how employees respond to different attack methods while creating opportunities for targeted improvement.

The goal is not to catch people out. It is to build confidence and encourage better decision-making over time.

Training becomes far more valuable when it reflects the threats employees are genuinely facing.

AI has not changed the objective of phishing attacks. Attackers still want access, information, or financial gain. What has changed is their ability to create convincing messages quickly and at scale.

Organisations that continue to rely on traditional awareness training risk preparing employees for a version of phishing that is becoming less common.

Modern awareness programmes should focus on verification, decision-making, and realistic threat scenarios rather than simply teaching staff to recognise obvious warning signs.

As phishing becomes more sophisticated, the most effective defence is a workforce that understands not only what an attack looks like, but also how to respond when a message appears legitimate.

Traditional security awareness training was designed for a threat landscape that looked very different from today's reality. As AI-powered phishing attacks become more convincing, organisations need awareness programmes that focus on verification, decision-making, and real-world attack scenarios rather than outdated indicators.

Portrona helps organisations strengthen their human layer of defence through tailored security awareness initiatives, phishing simulations, and risk-focused guidance. By combining user education with practical security controls and ongoing assessment, Portrona helps businesses build a security culture that adapts to evolving threats and reduces the likelihood of successful phishing attacks.