By Kumar Vaibhav
Cybersecurity has always been a game of cat and mouse. Attackers evolve their tactics quickly while defenders improve their safeguards. In recent years, however, the balance has shifted. Phishing, one of the oldest forms of cybercrime, has become a sophisticated, AI-powered threat that can bypass both technical controls and human judgment.
The days of easily identifying phishing emails by poor grammar, suspicious formatting, or obvious spelling mistakes are over. Today’s attacks look increasingly like legitimate business communications. This makes it harder than ever for employees to tell genuine requests from malicious tricks. As cybercriminals use artificial intelligence (AI), organisations must rethink how they tackle one of cybersecurity’s oldest challenges.
AI is making phishing smarter
AI has greatly improved the effectiveness of phishing attacks. Cybercriminals can now use generative AI to create highly convincing emails that mimic the tone, writing style, and communication patterns of colleagues, executives, suppliers, or customers.
By pulling information from company websites, social media profiles, and publicly available data, attackers can craft personalised messages that seem authentic and relevant. The threat goes beyond email, with voice phishing (vishing) and deepfake technologies enabling criminals to impersonate trusted individuals using realistic audio and video.
This has led to a new wave of phishing attacks that are scalable, credible, and designed to exploit human trust. Even experienced employees can have trouble spotting these increasingly advanced attempts.
Turning employees into defenders
Despite significant investments in cybersecurity technologies, phishing remains one of the most common causes of successful cyber breaches. The problem isn’t just a lack of security tools; people can make mistakes.
Employees under pressure, juggling multiple tasks, or working remotely often have to make quick decisions. A convincing email asking for urgent payment, a password reset, or document review can easily result in an accidental click on a malicious link.
However, calling employees the “weakest link” in cybersecurity ignores a crucial reality. With the right training and support, they can be one of the strongest layers of defence. Unlike automated systems, people can notice unusual context, question unexpected requests, and spot subtle warning signs that technology might overlook.
The key is creating a culture where employees feel encouraged to verify, question, and report suspicious activity without fear of consequences.
Why phishing simulations work
Traditional cybersecurity awareness programmes usually rely on annual presentations or generic online training modules. While these may fulfil compliance requirements, they seldom lead to lasting behaviour change.
More organisations are now using phishing simulation exercises that mimic real-world attack scenarios in a safe environment. Employees receive simulated phishing emails aimed at testing their ability to identify threats. If they engage with the email, immediate feedback explains what warning signs they missed and how to recognise similar attacks in the future.
These exercises help build practical skills and instinctive responses rather than just raising awareness. Over time, employees grow more confident in spotting suspicious activity and are more likely to report potential threats before damage occurs.
Regular simulations also offer valuable insight into organisational weaknesses, allowing businesses to improve training efforts where they are needed most.
Security is both a technology and people challenge
Effective phishing awareness offers benefits beyond just preventing a single cyberattack. It helps create a culture of shared responsibility where employees understand their role in protecting company information, customer data, and business operations.
This cultural change is crucial as organisations face stricter regulatory and compliance requirements. Showing ongoing security awareness training is often key to proving that reasonable security measures are in place.
Yet awareness training alone isn’t enough. Phishing defence needs a combination of informed users, strong security technologies, and continuous monitoring of emerging threats.
Specialist cybersecurity partners can provide significant value in this area. External experts offer access to advanced technologies, threat intelligence, AI-driven detection capabilities, and ongoing training programmes that reflect the latest attack methods. They help organisations combine human vigilance with technical controls, creating a more resilient security posture.
Shared vigilance is the new normal
Phishing isn’t going away. As AI continues to lower the barriers for cybercriminals, attacks will become more convincing and harder to detect.
Cybersecurity is a shared responsibility. The most effective defence isn’t just technology but a mix of informed employees, intelligent security systems, and expert guidance. When businesses empower their people, strengthen their technology, and partner with experienced experts, they build a strong defence against even the most sophisticated phishing attacks.
Kumar Vaibhav is the Lead Senior Solution Architect, Cybersecurity at In2IT
