Training on Fiction While the Real Threat is in Your Inbox

The author argues that common phishing simulation programs have become compliance-focused artifacts that fail to reflect real, increasingly AI-enhanced adversary tactics; organizations should shift to threat-informed, industry-specific training, prioritize employee report rates over simple click metrics, and integrate threat intelligence with simulation content and reporting to build a genuine human sensor layer.