Your security awareness platform teaches people to spot a message someone else sent. AI risk teaches people to judge a decision they are about to make themselves. Put AI security training next to phishing training and you are not comparing two versions of one program. You are comparing two different skills, which fail in different ways, and no amount of phishing simulation builds the second one.
That matters more than it used to, because the exposure has moved inside the company. Cyberhaven’s 2026 AI Adoption & Risk Report, published in February 2026, found that 39.7% of interactions with AI tools involve sensitive data, and that the average employee feeds something sensitive into one about every three days. Not one of those events looks like a phishing email, so not one of them shows up in a click-rate report.
Three different things get called AI security training
Most of the confusion here comes from one phrase doing three jobs. Before you can tell whether you have a gap, you have to know which of the three a vendor is selling you.
| What it is called | What it teaches | Who sells it |
|---|---|---|
| AI-upgraded phishing training | The same detect-and-report skill, with lures written by a model and extended to text, voice, and video | Security awareness platforms |
| Securing AI systems | Prompt injection, model and agent attack surface, red-teaming, the OWASP Top 10 for LLM Applications | Security vendors and technical course catalogs |
| Safe AI use by the workforce | Data classification, output verification, disclosure, escalation, when not to use the tool at all | Almost nobody |
The first is a feature release. The second is for engineers and security staff, maybe a dozen people in a company of 300. The third is what your finance team, your recruiters, and your account managers need by Monday, and it is the one the market under-serves.
What your security awareness platform already does well
Give the incumbent its due. A phishing program does four things nothing else does as cheaply:
- It produces audit evidence. Completion records satisfy insurers, HIPAA and PCI reviewers, and customer security questionnaires.
- It keeps a reporting habit alive. The report button, and the muscle memory of using it, is a real control.
- It scales to everyone at once, including contractors and seasonal staff.
- It has been upgraded for synthetic media. KnowBe4’s May 2026 release generates deepfake training scenarios and turns internal policy documents into modules, and its competitors have shipped similar.
Read that last bullet closely, because it is where buyers go wrong. The platforms added AI to the threat side of the curriculum. Deepfakes, prompt injection, and shadow AI appear as things that attack you. What did not get added is the part where your own staff now produce work with these tools and answer for the result.
Five risks a phishing program never reaches
Each is a judgment call made in seconds, by one person, with a deadline pressing. None has a malicious sender.
Classifying the document before it is pasted
The question is whether this contract, patient list, or salary band can go into this tool. The hard cases are the ordinary ones. A board deck with two slides of unannounced numbers. A customer spreadsheet with names stripped and account values intact. A support ticket quoting a user’s medical history in passing. Policy language cannot settle those, and a simulated email has never once asked anybody to try.
Verifying output nobody else will check
This is the most documented AI failure mode in professional work, and no awareness platform covers it. The AI Hallucination Cases database maintained by Damien Charlotin had logged 2,202 court decisions as of 19 October 2026 in which a court addressed someone’s reliance on AI-fabricated material. In 872 of them the party was a lawyer. These were not people who got phished. They were people who did not check, in a profession built on checking.
The same gap runs through every function that ships text: a sourced claim in a proposal, a figure in a board pack, a citation in a grant application.
Disclosing the tool you were not supposed to use
Phishing training asks staff to report someone else’s bad act, which is socially free. AI risk asks them to report their own, which is not. An employee who drafted a client memo in a personal chatbot account has every reason to stay quiet, and the strongest reason of all if your security culture runs on naming people who fail simulations. Cyberhaven measured most Claude and Perplexity use happening through personal accounts rather than company ones. You cannot govern what nobody will admit to.
Holding a process when the person on the call looks real
In January 2024 a finance employee in Arup’s Hong Kong office joined a video call with what appeared to be the company’s CFO and several colleagues, and approved transfers worth about US$25 million across 15 payments. CNN reported that every other participant on the call was synthetic. The employee had been skeptical of the original email, which is exactly what training teaches, and the skepticism did not survive seeing faces.
Detection was never the control that would have held here. What holds is a payment process that does not bend for seniority, rehearsed until refusing a convincing executive feels normal. That is a drill, not a module.
Knowing which account you are logged into
Consumer tier, business tier, enterprise tier, and a company account inside a personal browser profile look nearly identical in the interface and differ sharply in where your data goes and what is retained. Most staff have never been shown how to tell, and nobody has tested them on it.
Why click rate cannot see any of this
Security awareness training is built around a measurable act. Someone clicks or does not, reports or does not, and the platform counts it. That measurability is the whole reason the category exists, and it is also its ceiling.
The ceiling is well documented. In the largest field trial of the format, Grant Ho, Ariana Mirian and colleagues ran ten simulated campaigns across roughly 19,500 UC San Diego Health employees over eight months, publishing at the 2025 IEEE Symposium on Security and Privacy. They found no significant relationship between having recently finished the annual mandated training and resisting phishing. Embedded post-click training cut susceptibility by about 2%. Three quarters of people spent a minute or less on the material, and a third closed it without engaging at all.
Vendors answer with scale, and the answer deserves a hearing: KnowBe4’s public analysis covers more than 32 million users and nearly 494 million simulated tests, and reports that frequent testing tracks with better simulation performance. Both findings can hold. Frequent testing improves how people handle tests; the trial measured something else and found a thin effect.
Either way, what you get is a click rate, and the five risks above produce no click. Measuring safe AI use needs different instruments: sensitive pastes flagged per hundred staff per month, new tools disclosed voluntarily, deliverables shipped with an unverified AI-written claim, payment exceptions refused. Which of those actually move is covered in the measurement side of safe AI use.
Where the second obligation is written down
Three documents already assume you teach this, which helps when you need budget.
EU AI Act, Article 4. In force since 2 February 2025, with enforcement powers from 3 August 2026. It requires providers and deployers to make sure staff, and anyone operating an AI system on their behalf, have AI literacy suited to their role and to the risk of the system. It reaches contractors, and it is not satisfied by a security module about phishing. If you have EU staff, EU customers, or an EU entity, this is already live.
NIST AI Risk Management Framework. GOVERN 2.2 states that personnel and partners receive AI risk management training for their duties. US companies with no EU exposure still meet this language in security questionnaires, because buyers have started asking.
NIST SP 800-50r1 is the program-design reference for awareness and learning programs, and NIST 800-53’s AT control family is where the duty lands in a federal or defense supply chain. Use 800-50r1 for structure even if nothing obliges you to.
Worth saying plainly: compliance language gets the second program funded and tells you nothing about what the sessions should contain. Article 4 does not teach a recruiter how to classify a resume.
How the two layers divide
The two programs are not substitutes and the second is not a module inside the first. They have different owners, cadences, and evidence.
| Security awareness training | AI enablement with safe use built in | |
|---|---|---|
| Teaches | Recognize and report hostile messages | Judgment on data, verification, disclosure, escalation |
| Owner | IT or security | The function leader, with security setting the rules |
| Format | Short modules plus simulations | Hands-on sessions on the team’s own live work |
| Cadence | Continuous, light touch | A real session, then reinforcement in the workflow |
| Evidence | Click rate, report rate, completion | Disclosed tools, flagged pastes, verified deliverables, refused exceptions |
| Fails when | Lures outrun the templates | Nobody practiced on a document that mattered |
Running one and claiming the other is covered is the mistake we see most often. The second layer is where capability gets built, which is the argument we make about buying licenses and not getting ability.
What each layer costs
Market ranges, not quotes. Per-seat awareness platforms list in the low tens of dollars per user per year, with compliance content as a paid add-on and real discounts on volume and multi-year terms. A company of 200 is looking at a few thousand dollars a year for that layer, which is why nobody argues about it.
Instructor-led AI enablement work runs roughly $2,000 to $15,000 per engagement depending on session count, role tracks, and whether the material is built against your own documents. Follow-on automation projects, once a team can specify what it wants, run $25,000 to $150,000. The vendor-by-vendor picture is in the comparison of employee AI risk and safe-use training providers, and the budget arithmetic sits in what this training actually costs.
One framing that helps in a CFO conversation: the first layer is insurance, priced per head. The second is capability, priced per team, and it decides whether the licenses you already pay for are worth their invoice.
A diagnostic you can run this week
Six questions, each with a checkable answer and no vendor required.
- Pick three real documents from one team. Can the person who handles them say which tier of which tool each may go into, and why?
- Open your awareness platform’s catalog. Does any module ask the learner to verify a model’s output rather than spot an attack?
- Ask your data loss tooling how many sensitive pastes into AI tools it flagged last month. If the answer is zero, check whether it is watching.
- Count the AI tools staff disclosed voluntarily last quarter. In ISACA’s 2026 AI Pulse Poll, nine in ten respondents said employees were using AI and only a third said all employees were trained on it.
- Take one customer deliverable produced with AI help. Can anyone show which claims were checked?
- Ask your finance lead what happens if a convincing executive on video asks for an urgent transfer. Listen for a process, not a promise to be careful.
Two or more weak answers and your gap is capability, not awareness. What closes it is a session where people practice on their own live work with your policy in the room, not another module.
Our sessions are hands-on fluency training on ChatGPT, Claude, Gemini, and Microsoft Copilot applied to a team’s real documents, which is where classification and verification habits form. To find your weak answer before spending anything, book a free AI-readiness call.
Frequently asked questions
Is AI security training the same as phishing training?
They answer different questions. Phishing training teaches detection of hostile inbound messages. AI risk training teaches judgment about your own use of AI tools: what data may enter them, how to verify what comes out, when to disclose, and when to escalate. Some vendors use the phrase for a third thing, securing AI systems against prompt injection, which is a technical curriculum for engineers.
Does our security awareness platform already cover AI?
It covers AI as a threat. Check the catalog for deepfake recognition and AI-written phishing, which most now have. Then look for a module that asks the learner to classify one of your own documents or verify a model’s output. That second search usually comes up empty.
Can we just add an AI module to the program we already pay for?
For awareness, do it. It will not build judgment, because the format allows no practice on real work. A twelve-minute module cannot walk your controller through deciding whether a draft board pack may go into a chatbot.
Who should own AI risk training?
Security owns the rules and the tooling. The function leader owns the capability, because the judgment calls are specific to the work. Most mid-sized companies have no Chief AI Officer, so the job lands on a COO, Head of L&D, or Chief of Staff as a second role. Name that person, or nothing ships.
How often does this need to happen?
Once properly, then reinforced. A real session per role track at the start, refreshed when the approved tool list changes or a new tier appears. Awareness content stays on its drip. Treating AI judgment as an annual compliance item reproduces the failure the UC San Diego trial measured.
What about deepfakes, is that awareness or AI risk?
Both, and the split is useful. Recognizing synthetic media is awareness content and the platforms handle it. Holding a payment process when the video looks real is a rehearsed drill in finance, not a module.
Does the EU AI Act apply if we are a US company?
If you have EU employees, EU customers, or an EU entity, Article 4’s AI literacy duty reaches you as a deployer. If you have none of those it does not, though its language keeps appearing in customer security questionnaires, so being able to describe your program is worth the hour.
We banned AI tools. Do we still need this?
A ban makes it more urgent, not less. It moves usage to personal accounts, where you have no logs, no retention control, and no chance of disclosure. An unenforceable ban is a measurement blackout, and the fastest way to see what is happening is to make disclosure safe.
How do we measure AI risk training if click rate does not work?
Four numbers worth tracking from the first session: sensitive pastes flagged per hundred staff per month, tools disclosed voluntarily per quarter, share of audited customer deliverables with a verified-claims record, and payment exceptions correctly refused. Pick two, baseline them before the training, read them at sixty and ninety days.
Should we drop phishing simulations and spend the money here?
Keep both. The first layer is cheap, produces audit evidence, and keeps the reporting habit alive. The second is additive. Cutting the first to fund the second trades a working control for a new one and leaves you explaining the gap to an insurer.
Key takeaways
- Security awareness training teaches detection of someone else’s hostile act. Safe AI use teaches judgment about your own work. One does not substitute for the other.
- The five risks your phishing program cannot reach are data classification at the moment of paste, verification of AI output, voluntary disclosure, holding a process against convincing synthetic media, and knowing which account tier you are in.
- Click rate is the wrong instrument. Track flagged sensitive pastes, voluntary tool disclosures, verified deliverables, and refused payment exceptions.
- EU AI Act Article 4, NIST AI RMF GOVERN 2.2, and NIST SP 800-50r1 already assume you teach this. Use them for budget, not for curriculum.
- Keep the per-seat platform for audit evidence and the reporting habit. Fund the hands-on layer separately, because that is where capability gets built.
Dirk Jan van Veen, PhD
