Why Do We Keep Testing Employees for Yesterday's Phishing Attacks
CSO Online, Monday, November 2nd, 2026
A CSO Online contributor argues phishing tests should measure how staff verify AI-crafted messages, not just whether they spot old warning signs.
In this opinion piece, contributor Oludolamu Onimole says organizations keep testing staff against familiar phishing techniques while attackers use AI to craft convincing, personalized messages.
Traditional tells such as spelling mistakes, generic greetings and odd formatting are becoming less dependable.
The author cites Egress research reported by SC Media finding that 75% of phishing kits examined on dark-web markets advertised AI capabilities and 82% offered deepfake features.
The piece argues awareness training should emphasize verifying unexpected requests through a trusted channel, even when a message looks legitimate, and that simulations should measure how employees respond rather than only whether they click.