DEVELOPMENT AND EMPIRICAL VALIDATION OF A HYBRID ADAPTIVE PHISHING DETECTION FRAMEWORK FOR AI-DRIVEN THREATS AND RISK ASSESSMENT IN SMALL AND MEDIUM-SIZED ENTERPRISES (SMES)

ABSTRACT Building on these findings, the study highlights the critical need for alignment between technological controls and human behavior within organizational cybersecurity strategies. While advanced detection systems can significantly reduce the volume of malicious content reaching end users, they cannot entirely eliminate exposure, especially in the case of highly targeted and socially engineered attacks. As such, the persistence of phishing threats underscores the importance of reinforcing technical defenses with adaptive human-centered interventions that evolve alongside attacker tactics. The integrated framework proposed in this research emphasizes continuous feedback between AI-driven detection mechanisms and human awareness programs. Insights generated from the DMLCA model, such as emerging phishing patterns, commonly exploited themes, and high-risk communication channels, can be used to dynamically update training content. This ensures that awareness programs remain relevant, timely, and closely aligned with real-world threat landscapes. In turn, improved user behavior reduces the burden on automated systems, creating a mutually reinforcing security ecosystem. Additionally, the study reveals that one-off or compliance-driven training initiatives are insufficient for long-term risk reduction. Organizations that embedded cybersecurity awareness into routine workflows, leadership messaging, and policy enforcement demonstrated stronger resilience against phishing attempts. This finding suggests that security awareness should be treated as an ongoing organizational process rather than a periodic activity. The role of management support and institutional commitment emerged as key drivers of sustainable behavioral change. From a practical standpoint, the proposed framework is scalable and adaptable across organizations of different sizes and security maturities. Small and medium-sized enterprises, which often lack extensive security resources, can particularly benefit from combining lightweight AI-based detection tools with focused, scenario-driven training. Larger organizations, on the other hand, can integrate the framework into existing security operations centers and enterprise learning platforms for broader impact. In terms of academic contribution, this research bridges the gap between purely technical phishing detection studies and behavioral cybersecurity research. By empirically demonstrating the synergistic effect of combining AI-based detection with human-focused interventions, the study provides evidence for a holistic defense paradigm. Future research may extend this work by incorporating adaptive learning systems, cross-cultural behavioral analyses, and longitudinal studies to assess long-term effectiveness. Overall, the findings reinforce the notion that combating modern phishing threats requires a balanced integration of intelligent technologies and informed human participation. Such an approach is essential for achieving resilient, adaptive, and sustainable cybersecurity in increasingly complex digital environments.