Phishing in the Age of AI: How Attacks Got Better and How Defense Must Respond

Traditional phishing awareness training teaches people to look for spelling errors, generic salutations, and suspicious domains. AI has made all three of those detection signals unreliable.

How AI Changed Phishing

Scale and personalization: LLMs can generate thousands of highly personalized phishing emails from scraped LinkedIn and company website data. What previously required a skilled social engineer for a high-value target can now be applied at scale.

Voice cloning: AI-generated voice calls that convincingly impersonate executives (“Hi, this is [CEO name], I need you to process an urgent wire transfer…”) are being used in business email compromise attacks.

Convincing pretexts: Sophisticated attacks now use accurate organizational context — real colleague names, accurate project names, plausible scenarios — sourced from company communications and social media.

What Modern Defense Requires

FIDO2/WebAuthn everywhere: The only phishing-resistant MFA. Time-based OTP codes and SMS can be real-time relayed by a man-in-the-middle; FIDO2 keys can’t be. Deploying FIDO2 for all employees eliminates credential theft as a phishing outcome.

Email authentication (DMARC/DKIM/SPF) with strict policy: These don’t prevent phishing from lookalike domains, but they prevent attackers from directly spoofing your domain. Start with monitoring mode, then move to p=reject.

Behavioral training over awareness posters: Training that simulates real attacks and provides immediate feedback dramatically outperforms annual security awareness presentations. Organizations running regular phishing simulations maintain meaningfully lower click rates.

Why Simulated Phishing Programs Need Careful Design

Poorly designed phishing simulation programs can backfire, creating a culture of fear and resentment toward the security team rather than genuine behavior change, particularly when simulations are perceived as deliberately tricky or punitive rather than educational. Effective programs frame simulations explicitly as learning opportunities, provide immediate constructive feedback rather than punitive consequences for clicking, and gradually increase simulation sophistication over time rather than starting with the most deceptive techniques an organization’s security team can devise. Organizations that track click rate trends over time alongside qualitative employee feedback on the program get a more complete picture of whether their training investment is genuinely improving organizational resilience or simply training employees to recognize the specific patterns used in simulations without improving real-world judgment.

The Executive Targeting Problem Requires Different Defenses

Senior executives face disproportionate targeting in sophisticated phishing and business email compromise attacks, both because of their financial authority and because publicly available information about executives — conference speaking engagements, social media activity, press coverage — provides attackers with rich material for crafting convincing pretexts. Defending this population effectively often requires measures beyond standard organization-wide training: dedicated executive security awareness briefings covering the specific tactics used against high-profile targets, enhanced email authentication and verification procedures specifically for financial transaction requests regardless of apparent sender authority, and in some cases dedicated technical monitoring for impersonation attempts using executives’ names and likely communication patterns.

Building Verification Culture for High-Stakes Requests

The most effective defense against sophisticated business email compromise and CEO fraud attacks isn’t purely technical — it’s organizational culture around verification for high-stakes requests, particularly financial transactions or sensitive data sharing. Organizations that establish and consistently reinforce a norm of verifying unusual requests through a separate communication channel, regardless of how urgent or how seemingly authoritative the request appears, create meaningful friction against social engineering attacks that bypass technical controls entirely by exploiting human deference to apparent authority and urgency, a pattern that connects to the broader incident response readiness discussed in our incident response program guidance.

This article is part of our ongoing coverage of Cybersecurity. For related reading, see zero trust architecture and identity security and passkeys.

Measuring Program Effectiveness Beyond Click Rates

Click rate alone is an incomplete metric for phishing defense program effectiveness, since it doesn’t capture report rate — how often employees who recognize a suspicious email actually report it to security rather than simply deleting it or ignoring it. Organizations with mature phishing defense programs track report rate alongside click rate, recognizing that a high report rate provides genuine early warning value for real attacks beyond simulation exercises, and actively work to make reporting frictionless, often through a single-click report button integrated directly into the email client rather than requiring employees to forward suspicious emails manually to a security mailbox.