You Can't Spell Training Without AI: Nick Wolf on KnowTechTalk

Picture it: coffee in hand, you open an email from a vendor you work with every week. Right logo. Right tone. No typos. It's fake.

That's how Barb Paluszkiewicz opens episode 95 of KnowTechTalk. Then she asks the question every MSP should be asking right now: are we training people for today's attacks, or yesterday's?

Nick Wolf, Hook Security's VP of Sales, gives a straight answer. AI took the typos out of phishing, so typo-spotting is done. What's left to train is the pause: noticing urgency, emotion, and context before acting. And building a culture where people report a click fast instead of hiding it.

Listen to Ep. 95 on KnowTechTalk · Watch on YouTube

First, credit where it's due

Barb has hosted KnowTechTalk since 2018. She also runs CDN Technologies, an outsourced IT company in Oakville, Ontario. So she asks these questions as an MSP who lives them.

She opened with something most MSPs only say off-mic: MSPs hate security awareness training about as much as employees hate taking it. It's administrative. People don't take it seriously. MSPs spend their time chasing completions. That kind of candor is what makes the conversation worth your 25 minutes.

This is Nick's second time on the show. His first, Ep. 93 in April 2024, covered cyber insurance and warranties back when he was at Cork.

What changed when AI started writing the phishing?

Rewind five or ten years and the attacker was a guy in a hoodie typing emails by hand. Typos everywhere. Every "Nigerian prince" message gave itself away.

Now, Nick says, AI writes the message and scrapes LinkedIn to personalize it. Congrats on the new role. Loved your blog post. Oh, and while I have you: update this password, change this bank account, read me your MFA code.

"They're not only just really good without typos, but they're sophisticated enough where they're personalized." — Nick Wolf

So if a message has no mistakes and knows your job history, what's left to spot? That's the question the rest of the episode tries to answer. (We dug into the same thing in what 691 real phishing emails taught us about trust.)

So what should people look for instead?

Nick's answer: stop teaching spelling and graphics. Teach urgency, emotion, and context. Does this request create artificial panic? Does it ask you to skip the normal process? "I'm stuck in a meeting, just reply here" is a tell.

Then pause and ask three questions:

• Does this involve money?
• Does it involve credentials?
• Does it involve sensitive data?

If yes, verify on a second channel. Nick calls it a different kind of MFA. A text from your boss? Message them on Slack or Teams. An email asking for a callback? Call, but not the number in the email. Find it on their website.

That pause is the whole game, and it's psychology, not tech. If you want the why behind it, start with what Psychological Security (PsySec) is.

Are people really the problem?

Barb asked the question the industry has asked for twenty years. Nick called it "a dubious question." If employees feel blamed and watched all the time, they won't do the one thing that matters most: report a mistake.

"What we want is employees to be our greatest asset, our first line of defense... What we should be looking at isn't necessarily who's clicking on the bad links, but who's reporting them." — Nick Wolf

Worth sitting with for a second. What does your program measure today: clicks, or reports?

Why is training so hard to get done in a small business?

Barb put it well. At a big enterprise, they hand you slippers and send you to a quiet room for your training. At a small business, everyone is answering phones, processing orders, and sorting out billing. Fifteen minutes matters.

Nick has seen both sides. He came from Datto, a company with thousands of employees, and now works at Hook, with fewer than 100. In an SMB, he says, 20 minutes of training is 20 minutes taken away from work that keeps the lights on.

His fix is micro-learning. One to three minutes, one topic a month: ransomware this month, deepfakes next, voice phishing after that. No portals, no 55-question quizzes on a three-minute video. (More on why this matters in why SAT programs fail after month 2.)

Why do MSPs dread it too?

Barb listed the pain from the MSP side: setup, enrolling people, fielding complaints that the content "is from 1974." Nick said Hook hears the same thing from its partners. The MSP ends up playing parent, nagging clients to finish. Employees roll their eyes at a video they saw three months ago.

Hook's answer is Autopilot. The MSP connects a client through Microsoft or Google, and Hook runs the program: a new phishing simulation and a new micro-training every month, plus white-labeled reports, with nothing repeated from the previous 12 months. MSPs can still send custom content like HIPAA, GDPR, or deepfake training whenever a client needs it.

"My team is too smart to fall for it." Are they?

Barb asked for Nick's comeback to the business owner who says this. He didn't hesitate.

"Phishing doesn't test intelligence. It really tests and exploits human psychology, stress, and distraction." — Nick Wolf

He told a story on himself. While he was looking for his next role, he got a slick recruiter email that referenced his past companies and awards and dangled a big salary. The giveaway: a director at a major company doesn't email from a Gmail address. He wrote up the whole story here.

Barb added something every MSP will recognize. When the panicked call comes in, it's usually the owner or a partner who clicked. Nick's advice for the MSP's response: not "why did you click that?" but "thank you for calling us. You did the right thing."

If you could change one thing, what would it be?

Nick has spent 15 years in the channel. He's sold backup, MFA, XDR, and everything in between. His answer:

"Cybersecurity is a culture problem at the end of the day. It's not necessarily a software problem... You could buy all the firewalls, EDRs and AI tools in the world. But if your culture breeds fear, people will hide their mistakes." — Nick Wolf

His rule: see something, say something. Nobody ever got fired for sending the IT team 50 "is this phishing?" emails. Barb's follow-up was a good plug for MSPs: that's exactly the volume an MSP can absorb so the owner doesn't have to.

And the episode title? That came from Nick's closing line, "You can't spell training without AI." Barb said on the spot that she was stealing it.

Questions to take back to your team

• When someone clicks, how long until IT hears about it?
• Does your training teach people to hunt for typos, or to pause?
• What does an employee expect to happen if they report their own mistake?
• Are you tracking who reports, or only who clicks?

If those answers make you wince, that's the conversation Hook has with MSPs every day. See how Hook works with MSPs.

Listen to the full episode

Thanks to Barb and the CDN Technologies team for having Nick back. Catch episode 95 on the KnowTechTalk site, Apple Podcasts, Spotify, or YouTube. Then subscribe: KnowTechTalk has been putting practical IT and security advice in front of business owners for more than 90 episodes.

Want to keep the conversation going? Connect with Nick Wolf on LinkedIn, or read about why he joined Hook as VP of Sales.

FAQ

What is KnowTechTalk?

KnowTechTalk is a podcast hosted by Barb Paluszkiewicz of CDN Technologies, an outsourced IT company in Oakville, Ontario. It has run since 2018 and covers IT, cybersecurity, and technology advice for business owners.

How should employees spot AI-generated phishing?

Not by looking for typos. AI-written phishing is clean and personalized. Train people to notice urgency, emotion, and unusual requests, then pause and verify on a second channel whenever a message involves money, credentials, or sensitive data.

Does security awareness training work for small businesses?

Yes, when it respects their time. Nick recommends one-to-three-minute micro-trainings on one topic a month, paired with a culture that rewards reporting mistakes quickly instead of punishing them.