Adaptive AI Phishing Training: A Safer UK Model for 2026

Phishing training is often measured by how many people an organisation catches. That rewards convincing simulations, not safer operations. A strong programme reduces successful compromise, makes reporting quick and builds durable technical controls around the moments when people are most exposed.

This guide reflects current UK guidance and law as at 31 July 2026. It is intended for UK businesses and charities; public bodies and regulated sectors may have additional obligations. It does not replace security, employment or data-protection advice.

Start with the current threat, not a theatrical test

The government’s Cyber Security Breaches Survey 2025/2026 found phishing was experienced by 38% of businesses and 25% of charities, and was the most disruptive breach or attack for 69% of affected organisations. Phishing also dominated reported cyber crime. Those statistics describe survey findings, not an individual company’s risk, but they justify sustained attention.

AI changes message quality and variation, yet the defensive problem remains layered. Attackers exploit identity, payment processes, trusted suppliers, collaboration tools and recovery weaknesses. A simulation programme that improves click rate while leaving weak multifactor authentication, permissive mail rules or an untested payment callback process untouched is not resilience.

The NCSC’s phishing defence guidance explicitly cautions that simulations are often over-emphasised and that users cannot be trained to spot every malicious message. It recommends technical protections, a reporting culture, monitoring and rehearsed incident response. That is the design centre for adaptive training.

Define the outcomes before choosing AI

Use AI to select relevant learning, vary benign scenarios and help analysts triage reports. Do not use it to score a worker’s character, infer intent or automate discipline. Write a programme charter with three measurable outcomes:

• reduce the proportion of realistic attacks that reach an actionable point;
• shorten the time between receipt, worker report and containment;
• increase correct use of approved verification and recovery procedures.

“Actionable point” should reflect the scenario: credential entry, token approval, payment instruction, file execution, data disclosure or successful account recovery. A mere link click is an intermediate signal. Report it with context rather than turning it into a league table.

Baseline controls first: phishing-resistant MFA for high-risk accounts where feasible, secure email configuration, domain protections, least privilege, browser and endpoint controls, restricted OAuth consent, reliable backups, and independent verification for payment or bank-detail changes. Our UK cyber-resilience and incident-detection guide connects these preventive controls to the response function.

Segment by exposure, never by embarrassment

Adaptive learning should respond to work context. Accounts payable sees supplier changes; developers encounter repository and package lures; HR receives attachments and identity records; executives face impersonation; customer teams open unsolicited content. Build scenario families from approved threat intelligence and actual near misses, with sensitive details removed.

Set a maximum cadence and quiet periods around leave, bereavement, major incidents and intense operational events. Never imitate health emergencies, redundancies or personal family crises. Do not impersonate unions, clinicians or protected reporting channels. Make support available to people distressed by a scenario.

Use an evidence-based training loop

The programme should operate as a learning system:

• The security team approves a threat hypothesis and business process.
• HR, privacy and accessibility reviewers assess worker impact.
• The platform generates variants inside an approved template and vocabulary.
• A human checks links, landing pages, sender details and intended learning.
• A small canary group tests technical delivery and false-positive risk.
• The exercise runs with a visible, one-action reporting route.
• Reported messages enter the same triage workflow as real reports.
• Results change controls, content or process—not simply individual scores.

Use the NCSC’s free suspected phishing email exercise and broader Exercise in a Box as reference patterns for facilitated practice. Tabletop work is particularly valuable because teams can rehearse decisions without secretly monitoring people.

Every simulation should state its learning objective, target population, owner, approval, data fields, retention period and response route. Preserve the template and system version so a disputed result can be reconstructed.

Reporting culture is a security control

Provide an email-client report button, an alternative channel if the device may be compromised, and a clear path for voice, messaging and QR-code attacks. Acknowledge reports quickly. Tell the reporter what happened when disclosure is safe. Reward early reporting even if the person interacted with the message.

Triage should combine deterministic checks and analyst judgement. AI can summarise headers, URLs and prior reports, but it should not autonomously detonate unknown content in an unsafe environment or close a report solely because it resembles a benign campaign. Separate real messages from simulations at the orchestration layer so analysts know which playbook applies.

Link reports to containment actions: revoke sessions, reset credentials, remove malicious mail, block indicators, inspect OAuth grants, notify payment teams and preserve evidence. The NCSC’s logging and monitoring guidance says logging should support detection and investigation and align with an exercised incident plan. For design patterns beyond email, see our AI threat-detection and defence guide.

Worker privacy and fair monitoring

Simulation telemetry is worker personal data when it identifies a person. The ICO’s monitoring workers guidance says monitoring must be lawful, fair, transparent and proportionate; organisations should choose the least intrusive means and remain responsible for suppliers. The guidance is under review following the Data (Use and Access) Act, so check for updates.

Complete a legitimate-purpose assessment and, where high risk is likely, a DPIA before launch. Tell workers what is measured, why, who sees it, how long it is kept, how it affects them and how they can challenge an error. Consultation with worker representatives can reveal trust and accessibility risks that a security team will miss.

Minimise telemetry. An effective dashboard may need scenario ID, role cohort, interaction category, report time and remediation completion—not mailbox contents, keystrokes, webcam images or browsing history. Separate aggregate programme analytics from individual operational follow-up. Limit manager access and do not export raw results to broad HR systems.

Automated personalisation should not make solely automated decisions with significant employment effects. Human review must consider context, disability, language, equipment, workload and false events. A click caused by a security scanner or link preview is not human behaviour.

Secure the training platform

A phishing simulator has permission to send realistic messages, collect interactions and imitate trusted brands. Treat it as a high-impact supplier. Restrict administrative roles, enforce strong MFA, review sender domains, protect API keys and require dual approval for campaigns. Isolate landing pages from production identity systems and never collect real passwords.

Contract terms should address hosting, subprocessors, international transfers, retention, deletion, breach notification, audit, model training and support at exit. Ask whether generated scenarios or telemetry improve a shared model. The answer should be controlled by documented instruction, not a default checkbox.

Apply the NCSC’s secure AI system development guidelines, including monitoring inputs and behaviour, controlling supply-chain risk and restoring a known-good version. The government’s AI Cyber Security Code of Practice provides a complementary baseline. Test prompt injection in threat feeds, unsafe URL generation, tenant separation and unauthorised campaign launch.

Measure behaviour and system response together

Do not optimise one click-rate number. Use a balanced scorecard:

• median and 90th-percentile time to worker report;
• proportion of real and simulated reports triaged within the target;
• time to session revocation or malicious-mail removal;
• use of the callback process for payment and supplier changes;
• recurrence by attack pattern after targeted learning;
• false-positive and erroneous-attribution rate;
• technical-control coverage and bypasses found;
• worker trust, clarity and accessibility feedback.

Stratify results by scenario difficulty and channel. Do not publish small groups where individuals can be inferred. Compare equivalent scenarios over time; a harder campaign can raise interactions while the programme improves.

A measurable 90-day rollout

Days 1–30 — map and protect. Identify high-risk processes and recent incidents, assess existing controls, consult HR and privacy, complete the DPIA, and publish the charter. Baseline report times, containment times, MFA coverage, payment verification and worker sentiment.

Days 31–60 — small cohort. Pilot two approved scenario families with volunteers or a representative cohort. Run the same triage route as real mail. Test accessibility, false attribution, platform security, incident escalation and deletion. Fix process failures before increasing realism.

Days 61–90 — layered exercise. Expand by role, not organisation-wide blast. Pair simulations with a technical-control test and tabletop response. Review aggregate outcomes with security, HR, privacy and worker representatives. Approve the next quarter only after corrective actions have owners.

Proceed when all gates pass:

• 100% of exercises have documented purpose, approval and retention;
• zero collection of real credentials or unapproved message content;
• at least 95% of reports receive acknowledgement within the target;
• median report-to-triage and report-to-containment times improve;
• false attribution stays below the agreed threshold and is correctable;
• no critical supplier, access or privacy finding remains open;
• worker feedback shows the reporting route is understood and safe.

Pause a campaign if it causes distress, targets a protected channel, exposes personal data, misattributes automated scanning, or overwhelms incident response. Stop adaptive scoring if workers cannot understand or contest it. Suspend the platform after an unexplained vendor change, cross-tenant leak or unauthorised send. A mature programme teaches people to report and gives the organisation the capacity to act—not a reason to blame the person who encountered a well-designed attack.

Primary sources checked

• Cyber Security Breaches Survey 2025/2026, DSIT and Home Office, 30 April 2026
• Phishing attacks: defending your organisation, NCSC
• Suspected phishing email exercise, NCSC
• Exercise in a Box: getting started, NCSC
• Logging and monitoring, NCSC
• Data protection and monitoring workers, ICO
• Guidelines for secure AI system development, NCSC
• AI Cyber Security Code of Practice, DSIT