Security awareness training is being overmatched by cybercriminals who are enhancing attacks with generative AI — and moving phishing campaigns outside the inbox.