How can we train employees to spot "Deepfake" phishing attempts in corporate emails?

All answers to this question.

The game has definitely changed. You can no longer tell employees to "look for bad grammar." Attackers are using LLMs to write perfect, persuasive copy that looks exactly like a legitimate internal memo. The best defense is a "Verification Culture." If the CEO asks for a wire transfer or sensitive data, employees should be trained to verify that request through a second, out-of-band channel—like a quick Slack message or a phone call. We started implementing this in late 2023 and it’s the only thing that works against high-fidelity impersonation. Don't rely on the tech alone; empower the people.

   Answered 2025-12-08 by Martha Stewart

Have you considered running simulated "vishing" (voice phishing) tests using AI-generated voices to show your team how realistic they sound?

   Answered 2025-12-09 by Keith Richards

• Simulated attacks are great, Keith, but you have to be careful not to destroy employee morale. If the test is too "tricky," people feel stupid and stop caring. The goal is education, not a "gotcha" moment. I like to use these tests to show how techniques like urgency and authority are weaponized by hackers. Once they see the psychological "triggers" being used, they become much more skeptical of any email that demands immediate, secret action, regardless of who it’s supposedly from.

     Commented 2025-12-10 by Gerald Ford

Security awareness training needs to be monthly, not yearly. It has to stay fresh in their minds because the tactics evolve so fast.

   Answered 2025-12-11 by Ronald Mcdonald

• Totally agree. We do "Security Minutes" in our weekly meetings now just to keep everyone on their toes. It really helps build that culture.

     Commented 2025-12-12 by Janet Peterson