Same humans, smarter attacker: What three years of AI development has done to security awareness training

In 2024, my research published at MODSIM World used GPT-4.0 to simulate 50 human personas and test them against twelve social engineering scenarios, each assigned a distinct profile and level of security awareness training. The research evaluated whether a newly developed Social Engineering Awareness Training (SEAT) framework outperformed existing benchmarks including CIS, NIST, and the Australian ISM. The finding was cautiously optimistic: training worked.

That research used AI as a controlled methodology - a simulator on the defender’s side. What it did not anticipate was that by 2026, the attacker would have the same tools.

This talk presents a 2026 expansion of that original research. Using current-generation models, it does three things the 2024 study could not: it runs the attack rather than just the defence, generating personalised social engineering attempts targeting each persona’s specific profile; it quantifies the gap between 2024 and 2026 attacker capability using the same baseline personas and scenarios; and it stress-tests the SEAT framework against an AI-augmented adversary to determine whether a training framework designed before AI-powered attacks existed is structurally equipped to defend against them.

The findings are not reassuring. But they are actionable. The talk closes with a practical assessment of what security awareness training needs to look like when the attacker is no longer sending bulk phishing emails but generating targeted, personalised, and continuously refined social engineering at scale.