Two major reports published in the past six months arrive at the same conclusion from different directions. Group-IB's Weaponized AI white paper documents the technical mechanics of how AI has industrialised cybercrime. The World Economic Forum's Global Cybersecurity Outlook 2026 captures the organisational consequences: 73% of respondents said they or someone in their network had been personally affected by cyber enabled fraud in 2025, and for the first time, cyber enabled fraud, not ransomware, has become the top concern of CEOs globally.
At the centre of almost every incident sits a human being who was deceived, manipulated, or coerced. For organisations still relying on annual compliance videos and basic phishing simulations, that remains an entirely predictable outcome.
The Threat Has Industrialised. Training Hasn't.
Attackers in 2025 are role-aware, culturally precise, and operating at machine speed. Group-IB documents platforms like SpamGPT marketing themselves as fully autonomous spam agents — dynamically rewriting content to evade filters, personalising lures per target, and validating inboxes automatically. AI-assisted scam call centres deploy real-time speech pipelines that coach operators during live fraud calls. North Korean state actors linked to the Lazarus group used deepfake technology to pass job interviews at over 300 US companies, operating as insider threats for months. In November 2025, Anthropic disclosed the first confirmed case of agentic AI executing an attack across the entire kill chain — from reconnaissance through to data exfiltration.
The WEF report adds the economic dimension: Jaguar Land Rover's August 2025 attack halted global production for five weeks, cost the company £196 million directly, and inflicted an estimated £1.9 billion in broader economic losses on the UK economy. UK government research puts the average cost of a significant cyberattack at nearly £195,000 per business — scaling to £14.7 billion in annual national losses.
The Skills Shortage Makes It Worse
The WEF report identifies a finding with direct implications for how organisations should respond. Among those reporting insufficient cyber resilience, 85% also cited missing critical people and skills. Among highly resilient organisations, only 22% said the same. The gap between those two numbers is not primarily a budget problem — it is a capability and programme design problem.
Organisations need platforms that extend the reach of lean security teams, embed protective behaviour directly into the workforce, and automate the identification and remediation of human risk — without requiring headcount that simply isn't available.
OutThink: Built for This Environment
OutThink, available through Endida, is an AI-first human risk management platform designed for the threat landscape both reports describe.
Its three integrated capabilities work together to move organisations from periodic awareness to continuous protection.
OutThink's Adaptive Security Awareness Training adjusts content based on each user's demonstrated knowledge, role, and behaviour. A finance director handling international payments receives materially different training from a junior developer, mirroring the targeting logic attackers use, and countering it directly. The world's first two-way conversational format drives engagement and retention that compliance modules cannot achieve.
OutThink's AI‑Powered Phishing Simulator is built to reflect today’s threat landscape and how people actually behave. Designed by ex‑CISOs and grounded in decades of behavioural science research, it uses the same social engineering tactics real attackers rely on to create authentic, teachable moments. Simulations are hyper‑customised, with full control over content, difficulty, and sending domains. Users who fall for a simulation are automatically enrolled in contextual in‑simulation training, providing coachable moments and root cause analysis (i.e. Why did the user click?)."
OutThink's Human Risk Intelligence (HRI) is the world’s first purpose‑built human risk management capability, combining behavioural science, user telemetry, and organisational context. HRI quantifies and visualises individual and organisational risk in real time, enabling security teams to identify high‑risk individuals, understand the underlying drivers, and take proportionate action.
What Resilient Organisations Actually Do
The WEF's Cyber Resilience Compass is unambiguous about what separates highly resilient organisations from those falling behind. Resilient organisations are 3.5 times more likely to have the skills needed to meet cybersecurity objectives. They are more than twice as likely to assess AI tools before deployment. They involve security in procurement, simulate incidents with ecosystem partners, and treat human risk as an ongoing operational discipline — not an annual obligation.
OutThink maps directly onto each of these hallmarks. It is recognised as the highest‑rated security awareness solution in the Gartner Peer Insights report, with a 4.9‑star rating — this reflects measurable outcomes: a fourfold increase in phishing reporting rates and a sustained reduction in risky behaviours across its user base.
The Bottom Line
Dark web posts referencing AI keywords grew 371% between 2019 and 2025. Deepfake-as-a-Service sellers are up 233% year-on-year. DarkLLMs are available by subscription for as little as US$30 per month. The barrier to launching a sophisticated, human-targeted attack has never been lower. The economic consequences of a successful one have never been higher.
Your people are already a target. The question is whether your security programme is built to match the sophistication of those coming for them.
To explore OutThink through Endida, visit https://endida.com/endida-human-risk.html or book a demonstration.
Photo by Annie Spratt on Unsplash