What has changed?
Attackers use AI to write convincing emails in fluent, natural language, tailored to the recipient and the business. According to Microsoft, more than half of recipients click on AI-assisted phishing campaigns, compared with around one in eight for traditional campaigns.
Why training isn't enough
Training still matters, but when a scam is good enough, someone will click sooner or later. Your security has to hold up when that happens. The most important safeguard is a sign-in method that users can't be tricked into giving away: passkeys or other phishing-resistant methods.
Multiple layers of defense
Beyond that, email should be scanned for malicious links and attachments, payment procedures need a verification step that doesn't rely on email alone, and unusual sign-ins should be blocked automatically.
What we recommend
- Roll out phishing-resistant sign-in for everyone
- Turn on advanced email protection
- Require confirmation outside of email whenever a bank account number changes
- Run regular phishing simulations
How we can help
Wondering what this means for your organization? Let's talk.
Request a meeting →