How AI Is Reshaping Cybersecurity Training: 6 Takeaways for L&D and Security Leaders

For years, security awareness training taught employees to spot phishing by its mistakes: typos, bad grammar, a generic greeting, a logo that looked off. Generative AI erased most of those tells. Attackers can now write flawless, personalized messages in any language, clone a voice in minutes, and even fake an entire video call.

So how should L&D and security leaders train people for threats that look exactly like the real thing?

Here are six shifts L&D and security leaders should plan for now.

🎥 Short on time? Watch the full webinar on demand → https://watch.getcontrast.io/register/edflex-en-cybersecurity-webinar 

1. Teach people to judge the request, not spot the typos

Security awareness training used to be a once-a-year, check-the-box exercise, and success meant a completion rate. Phishing simulations, microlearning and more frequent, interactive training followed.

Then generative AI erased the classic tells: typos, bad grammar, a generic greeting, a logo that looks off. Attackers can now write flawless, personalized messages in any language, for thousands of people at once.

“A polished email doesn’t really prove anything anymore.”

So instead of judging how a message looks, employees need to judge what it asks:

• Was I expecting this?
• Does it involve money, credentials or confidential information?
• Is someone pressuring me to rush or skip a normal step?

If the answer to any of these is yes, verify through a channel you already trust, like calling a number you already have. That shift, from spotting mistakes to making informed decisions, applies to email, text (smishing), phone (vishing) and video-meeting attacks alike.

2. Prevention alone isn't enough: build for resilience

Prevention-only strategies can't keep up. New vulnerabilities surface constantly, and AI has compressed what once took weeks or months of reverse engineering into a much faster process.

“We have to realize that we’re probably gonna get hit.”

The answer starts with the fundamentals: control inbound and outbound traffic, separate your network segments, block direct DNS queries, and don't let servers initiate connections. Steps like these make you a harder target, and most breaches still exploit basics that were never put in place.

Then design for the hit. A warship isn't built on the assumption it will never be struck. It's compartmentalized, so damage stays contained and the mission continues. Networks should work the same way.

3. Make training stick with the ACT framework

Training that changes behavior rests on three moves, summed up as ACT:

• A: Adaptive and experiential learning. One size doesn't fit all. Training should adjust difficulty to each person, because a finance manager and a software developer don't face the same risks. Learning by doing, such as building a phishing lure from the attacker's side, builds deeper intuition than a passive lecture.
• C: Continuous spaced reinforcement. Without practice, people forget much of what they learn within weeks. Short bursts of 2–5 minutes and 1–3 minute videos keep skills fresh and respect how little time employees have for training.
• T: Tactical active threat reporting. Shift the main metric from "avoiding clicks" to actively reporting threats. A one-click report button with instant feedback, and a thank-you when someone catches a real threat, keeps people reporting.

Why it matters: in the widely reported Hong Kong case, a finance worker transferred about $25 million after a video call where every other participant was an AI deepfake.

4. Plan for practice, personalization and constant updates

Over the next two to three years, security training is moving in three directions:

• More practice, not just more content. Simulations will expand to voice cloning and deepfake video. The goal is muscle memory: like learning to hit a baseball, people need repeated practice, not just an explanation.
• Personalization at scale. Attackers already use AI to personalize their attacks. Training teams can do the same, tailoring content by role, geography and industry so it feels relevant.
• A wider curriculum. Beyond AI-driven threats, employees need guidance on using AI safely at work, such as not uploading confidential information to AI tools.

“You have to budget for a solution, and you really need a lot of content and updated content.”

In practice, that means a year-round program with a large, constantly updated content library, not a one-time course. The threat landscape changes too quickly for anything else.

5. What to do Monday morning: the 3 Ps

If an L&D or security manager could do one thing tomorrow morning to strengthen their program, it comes down to three principles. A strong program should be:

1. Positive. Stop treating employees as the weakest link. Trained and empowered, they're threat detectors across the whole company. Celebrate someone who caught and reported a suspicious email in your next town hall or Slack channel.
2. Proactive. Make reporting effortless. Add a one-click "report phishing" button to Outlook or Gmail and make sure people get feedback, so reports don't disappear into an "IT black hole."
3. Personalized. Skip generic, company-wide messages. Segment your audience and match simulations to roles, for example executive-impersonation and wire-transfer scenarios for finance.

6. Measure behavior, not just completion

The question L&D leaders ask most: how do you report success?

• Track behavior, not only completion. Completion rates still matter, but the real question is whether people apply what they learned at work. Behavioral assessments and security culture are the next level.
• Set realistic click-rate goals. Someone will always click. Organizations often start with phishing-simulation click rates around 20–30% and can bring them down to roughly 2–4% with training and simulations.
• Plan remedial training. Some people click repeatedly. Have varied follow-up content and coaching ready, not the same module again.
• Measure containment. Resilience is the ultimate metric.

“As long as I can take the hit, control the blast radius, it’s a win in security.”

Organizations can also turn the same AI tools attackers use toward their own simulations and assessments, making them more personal.

Watch the full webinar on demand

These takeaways only scratch the surface. In the full session, you'll hear the stories behind them, including Kevin's lessons from Navy ships and red-team engagements, Tre's full ACT and 3 Ps frameworks, and John's view of where security training is headed next.

Featuring:

• John Trest, Chief Learning Officer, Inspired eLearning (VIPRE Security Group)
• Tre Fears, Instructional Design Lead, Inspired eLearning (VIPRE Security Group)
• Kevin Cardwell, cybersecurity expert, author and instructor, Starweaver
• Luis Camacho, Director of Customer Success, North America, Edflex (moderator)

‍

▶ Watch the webinar on demand https://watch.getcontrast.io/register/edflex-en-cybersecurity-webinar 

Looking for security awareness training for your teams? Inspired eLearning's courses are now available in the Edflex catalog. Learn more about the partnership.

‍