AI Is Rewriting the Social Engineering Playbook. Security Awareness Training Hasn't Caught Up. Organizations must KnowBetter.

NEW YORK CITY, NY / ACCESS Newswire / July 8, 2026 / Security teams have spent two decades training employees to spot a familiar set of red flags: a suspicious link, a misspelled domain, an urgent request for a wire transfer. That approach is now colliding with an attacker toolkit that has changed faster than most awareness programs have.

Generative AI has made it possible to clone a voice from a few seconds of audio, generate a passable deepfake video in minutes, and write a phishing email tailored to a specific employee's role, manager, and recent LinkedIn activity. Vishing calls, smishing texts, and video-based impersonation are now standard components of enterprise social engineering campaigns, not edge cases.

"Most organizations are still training people to recognize threats from five years ago," said Tal Shlomo, co-founder and CEO of Frame Security, a human risk management platform. "The phishing template hasn't changed, but the attacker has. A single click of AI generated audio can now sound exactly like a CFO asking for a wire transfer, and no amount of static training slides prepares someone for that."

The gap shows up in how many awareness programs are actually run. Industry surveys have repeatedly found that a large share of organizations still rely on a small library of generic phishing templates, a single difficulty level applied to every employee regardless of role or risk, and annual or semiannual training cycles that update on a much slower timeline than the threats they're meant to address.

Frame is among a newer group of security vendors arguing that awareness training needs to move at the same pace as the threats it's meant to counter. The company's platform builds phishing, vishing, and deepfake simulations from an organization's own context rather than a shared template library, and adjusts difficulty per employee based on demonstrated risk. It also ties a Human Risk Score to concrete signals, rather than relying solely on simulated click-through rates.

"Boards and CISOs are asking a different question now," Shlomo said. "It's no longer just how many people clicked a fake email. It's whether the organization actually understands where its human risk sits today, across every channel attackers are using, and whether that risk is going down over time."

The shift comes as regulators and cyber insurers are also paying closer attention to how companies measure and reduce human risk, rather than simply confirming that annual training was completed. That change in expectations, more than any single product, is likely to push enterprise security teams toward tools built for how people are actually being attacked today.

That shift matters beyond risk reduction. As enterprises weave AI into sales, customer support, and internal operations, a demonstrably mature human risk posture is becoming a business advantage rather than a defensive cost. Enterprise buyers increasingly ask about it during procurement, insurers factor it into premiums, and boards treat it as part of overall operational readiness for AI adoption.

"When enterprise buyers evaluate a vendor now, human risk posture is part of the conversation, not an afterthought," Shlomo said. "Companies that can show they have this under control move through procurement and security reviews faster. In the AI era, that speed is a competitive advantage, not just a compliance checkbox."

Frame Security made the case for that shift this week with the launch of KnowBetter, a campaign contrasting decades-old security awareness training against an AI-personalized approach built for how employees are actually being targeted today. We must go way beyond traditional awareness. The campaign is live at https://framesecurity.com/knowbetter.

Contact Information:
Ofir Zimber
info@framesecurity.com
+1 347-843-5223

SOURCE: Frame