Phishing Scores Will Be Gone in 18 Months: The Future of Social Engineering

Phishing Scores Will Be Gone in 18 Months: The Future of Social Engineering

by Cloud Security Podcast

Applied Sciences & Engineering Computing & Cybersecurity URComputer securityURHComputer fraud and hacking
🎙 Cloud Security Podcast 👥 39K 📅 September 5, 2025 ⏱ 39 min 👁 8K 📄 expert opinion 🧭 2026-08-17
Available in: English (current) Français

Keywords

social engineeringAIphishingCISOdefense

Summary

In this episode of the Cloud Security Podcast, host Ashish Rajan interviews Bobby Ford, a former CISO with over 14 years of experience, now Chief Strategy & Experience Officer at Doppel. They discuss the evolution of social engineering in the age of generative AI. Ford argues that traditional phishing metrics, such as click-through rates, will become obsolete within 12 to 18 months. He highlights that AI-powered attacks are hyper-personalized, multi-channel, and occur at unprecedented speed and scale, making them undetectable by the naked eye. The conversation covers the failure of conventional security awareness training, the innovative tactics of threat groups like Scattered Spider, and the shift towards measuring an organization’s overall ‘social engineering susceptibility.’ Ford advocates for a defense strategy that uses AI to counter AI, focusing on proactive takedown of malicious infrastructure before it reaches employees. The episode also touches on the importance of gaining visibility across all communication channels, including SMS and messaging apps, and the need for holistic security awareness beyond checkbox compliance.

166 words

Critical Evaluation

Value of the Information & Strength of the Argument

The episode provides valuable insights into the current state and future trajectory of social engineering attacks. Bobby Ford’s arguments are well-structured and grounded in his extensive experience as a CISO. He effectively explains how AI has transformed attacks, making them more personalized and harder to detect. The discussion on the inadequacy of traditional phishing metrics is compelling, and the proposal to shift towards measuring ‘social engineering susceptibility’ offers a fresh perspective. Ford’s emphasis on proactive infrastructure takedowns as a defense strategy is practical and forward-thinking. The argumentation is coherent, though some claims, such as the 18-month timeline for phishing scores to disappear, are speculative and lack empirical evidence.

Scientific Rigor, Source Quality, Title Accuracy

The episode maintains a high level of rigor in its discussion, with Bobby Ford drawing on real-world examples and his professional background. The mention of Scattered Spider adds credibility, as it is a known threat actor. However, the conversation is primarily opinion-based, with no formal citations or references to academic studies or industry reports. The title accurately reflects the content, focusing on the predicted decline of phishing scores. The podcast’s description provides links to its website and social media, but these are not direct sources for the claims made. Overall, the content is informative but relies on expert opinion rather than verifiable data.

226 words

Title / Content Match

The title accurately reflects the core thesis of the episode, which is the predicted decline of phishing click-through metrics in favor of broader social engineering susceptibility measures.

Quality & Reliability

7/10

The discussion is grounded in the extensive CISO experience of the guest, Bobby Ford, and references real-world threat actors like Scattered Spider. However, claims about the obsolescence of phishing scores are forward-looking and not backed by empirical data or formal studies.

Chapters

Cited Sources

Concurring Sources

Contribution & Novelties

The episode offers a novel perspective on the future of social engineering defense, arguing that traditional phishing metrics are becoming obsolete and that organizations should adopt a broader ‘social engineering susceptibility’ metric. It emphasizes the need for AI-driven defenses and proactive infrastructure takedowns, which is a shift from reactive user training. The discussion provides practical insights for CISOs and security professionals.

Pour aller plus loin :

97 words

Radar Profile

The radar profile shows high scores in quality of information and fiabilité, reflecting the expert insights and credible examples. The lower score in technical level indicates that the content is accessible to a broad audience, while the quantity of information is moderate, as the episode focuses on a specific topic.

Reliability 7/10

💬 No comments were provided for analysis.