The Hacker News – Cybersecurity 2026: Human Security

Key takeaways

• Verizon's 2024 Data Breach Investigations Report says the human element was involved in 68% of breaches, driving a shift from annual awareness training to continuous, personalized human-risk programs.
• The article says generative AI has made social engineering faster, cheaper, and easier to scale across email, voice, SMS, and video, including phishing emails, cloned voices, and deepfake videos.
• Adaptive Security's platform simulates AI-powered attacks such as deepfake phone calls, cloned executive voices, AI-generated phishing emails, and text messages, then delivers training immediately when employees fail a simulation.
• Adaptive says Bay Federal Credit Union cut its phishing failure rate by 86% over six months, from about 8% to 1%, using simulated attacks plus point-in-time training.
• Adaptive's Auto-Phish engine uses organizational context like org structure, vendors, employee click history, and public information to generate tailored attack scenarios, score risk, and support training, multi-channel simulations, phishing triage, and executive exposure monitoring.
• At Dental Depot, a healthcare network with more than 40 locations, reported-email triage fell from 10-15 minutes of manual IT review to less than a minute, and the article argues stronger verification processes are needed as voice and face become less reliable identity signals.

Want more from Adaptive in your Google results?

As cloud, AI, and distributed systems reshape cybersecurity, organizations are moving toward continuous visibility, control, and risk response at scale. This article is from The Hacker News Cybersecurity 2026 report, which features Andrew Jones, Co-Founder and CPO of Adaptive Security, on why human risk and stronger verification are now central to that shift.

Overview

Cybersecurity has traditionally focused on protecting networks, applications, and data. But attackers increasingly target the people who use those systems. According to Verizon's 2024 Data Breach Investigations Report, the human element was involved in 68% of breaches, underscoring the role employees play in an organization's overall security posture.

For years, human security largely meant annual awareness training and occasional simulated phishing campaigns. However, generative AI is changing both the scale and sophistication of social engineering. Attackers can now create convincing phishing emails, clone voices, generate deepfake videos, and impersonate trusted individuals faster and at a scale that was previously far more difficult to achieve.

As a result, organizations are moving beyond one-size-fits-all awareness programs toward more continuous and personalized approaches to managing human risk. Training and simulations are increasingly being tailored to individual roles, while security teams look to identify which employees are most exposed to particular forms of attack and respond accordingly.

The attack surface is also expanding beyond email. Voice, SMS, and video are becoming major channels for impersonation and fraud, while AI is making traditional indicators of identity less reliable. A familiar voice or face can no longer always be treated as proof of who someone claims to be.

The future of human security will therefore depend not only on helping employees recognize increasingly sophisticated attacks, but on building stronger verification into everyday workflows. As AI-powered deception continues to evolve, organizations will need security programs that can continuously test, assess, train, and adapt at the same pace.


Key Trends

• AI-powered social engineering is making phishing, voice cloning, and deepfake attacks faster, cheaper, and easier to scale.
• Human security is moving beyond annual awareness training toward continuous, personalized simulations and risk-based remediation.
• As attacks expand across voice, SMS, and video, stronger verification processes will become increasingly important for organizational resilience.

Andrew Jones, co-founder and chief product officer, describes the company's mission simply: "Our mission is to protect people from AI-powered cyberattacks." As AI makes phishing, voice cloning, deepfakes, and other forms of social engineering easier to deploy at scale, Adaptive is building its platform around that mission.

The platform simulates the AI-powered attacks criminals are already using, including deepfake phone calls, cloned executive voices, AI-generated phishing emails, and text messages. When employees fail a simulation, they can be trained at that point rather than waiting for the next scheduled awareness program. More than 1,000 organizations across industries including banking, healthcare, hospitality, professional sports, and government use the platform.

This approach is designed to produce measurable improvements rather than simply demonstrating that employees have completed a training program. At Bay Federal Credit Union, Adaptive Security says that simulating attacks and training employees when they failed reduced the organization's phishing failure rate by 86% over six months, from approximately eight percent to one percent.

What differentiates Adaptive Security is how those simulations are created. Rather than relying on the same library of phishing templates for every organization, the platform builds scenarios around the company's own environment, using information such as its organizational structure, vendors, employee click history, and publicly available information about its people. This allows simulations to reflect the types of attacks employees are more likely to encounter in practice.

As Jones explains, AI has changed the scale of the problem. "One attacker can generate a deepfake voice, write a convincing email and text a target within minutes, then run that attack against every employee at a company at once." Adaptive Security applies that same ability to operate at scale on the defensive side.

Its Auto-Phish engine powers this approach, using that organizational context to generate phishing and deepfake scenarios and score risk based on how employees respond. That intelligence then feeds into four connected areas: personalized security awareness training, multi-channel phishing simulations across email, voice, SMS, and video, automated phishing triage, and executive exposure monitoring. Together, these capabilities allow Adaptive Security to identify human risk, simulate relevant attacks, and provide a more targeted response across the organization.

The platform is also expanding beyond simulation and training. Its email security capability uses multiple AI agents to assess a message's intent, visual content, links, and whether similar lures are targeting other employees. When a message is identified as malicious, it can be removed automatically from inboxes across the organization.

The impact of this automation can also be seen in phishing triage. At Dental Depot, a healthcare network with more than 40 locations, reviewing a reported email manually previously took the IT team between 10 and 15 minutes. According to the company, that process now takes less than a minute.

Looking ahead, Jones sees identity and verification becoming increasingly important as AI makes traditional signals of authenticity less reliable. "A voice or a face used to be enough evidence of who someone was. That evidence is losing its reliability fast." As attacks continue to move across voice, video, SMS, and other channels, organizations will need to establish stronger verification processes alongside technology and training.

By connecting AI-powered simulations, personalized training, risk assessment, and automated response, Adaptive is helping organizations build a more continuous defense against human-focused cyber threats.