An automated spear phishing system matched human experts in a controlled study: 54% of recipients clicked. The result is a warning about the cost of personalization, not a prediction that half your workforce will fall for the next email.
For years, targeted phishing required someone to research a recipient, understand their work and write a plausible request. That effort limited how many people an attacker could approach individually. AI can automate much of it. The defensive question is what happens when an email looks credible enough to get past a person, a filter or an AI assistant.
The NIST Phish Scale helps explain why context matters. Research experiments show what automation can achieve. Incident reports show why payment verification, authentication and agent permissions still need to hold when the message is convincing.
What the 54% result actually measures
Fred Heiding and colleagues compared four types of email across 101 participants. The automated system gathered public information, built recipient profiles and generated personalized messages. Its click rate matched the human experts in that experiment. [2]
Automated messages matched the experts
Recipients who clicked a link, by experimental group
This small controlled study does not establish a universal phishing success rate. The two percentage point gap between AI with human review and fully automated AI should not be treated as proof that human review improves attack performance.
The authors reported accurate target profiles in 88% of cases. Their estimate of up to 50 times greater profitability is an economic model, not measured criminal proceeds. The research first appeared as a preprint in November 2024 and was published in Expert Systems with Applications in 2026. Microsoft’s 2025 report cites the same work, so its 54% and 12% figures are not an independent replication. [3] [9]
IBM’s 2023 experiment offers a separate observation about production time. X-Force generated a phishing email in five minutes, compared with roughly 16 hours for its team’s process. Humans performed slightly better in that test. Different participants, messages and methods prevent treating IBM and Heiding’s results as a controlled year-to-year improvement curve. [4]
Why a convincing premise matters more than clean grammar
NIST published the Phish Scale user guide in November 2023 to help teams interpret phishing simulations. It rates human detection difficulty using two components: observable cues and how closely the message fits the recipient’s work. It is not an AI detector or a score for an entire campaign. [1]
Cues include spelling errors, suspicious links, presentation problems and common persuasion tactics. The guide lists 23 cues in five categories and counts each occurrence. Premise alignment considers relevance to the person’s responsibilities, familiar business processes, current events and the consequences implied by the request. Relevant prior training reduces the alignment score.
A familiar request can be difficult to challenge
Find the cue count, then the strength of the premise.
Swipe or scroll horizontally to compare all columns.
| Observable cues | Weak premise | Medium premise | Strong premise |
|---|---|---|---|
| Few 1–8 cues | Moderately difficult | Very difficult | Very difficult |
| Some 9–14 cues | Moderately to least difficult | Moderately difficult | Very difficult |
| Many 15+ cues | Least difficult | Moderately difficult | Moderately difficult |
Our reading is that AI can reduce obvious language errors and help align a message with someone’s role. That can make detection harder. It does not establish that every AI email is “very difficult,” and the study above did not assign NIST ratings to every message.
Polished writing also does not remove every cue. Sender and destination domains, attachments, unexpected requests and inconsistencies can still matter. In Spanish and Portuguese, better localization may remove awkward translation as a warning sign. Teams should practice the payment, account recovery and document sharing decisions they actually make, rather than rely on poor grammar to identify an attack.
What field data adds, and what it cannot prove
Several sources show rising exposure or losses. They measure different things: reported messages, vendor classifications, unique phishing sites and complaints. Combining them into a single AI phishing prevalence rate would be misleading.
4% → 56% → 40%
Hoxhunt found indicators of AI assistance in 4% of its November 2025 sample, 56% in December and 40% in January 2026. These were reported threats that reached inboxes. Classification used visible text and HTML indicators, and November’s sample was smaller. This is not a census of all email or definitive proof of how each message was created. [5]
86% classified as AI driven
KnowBe4 reported this share for phishing attacks in the six months covered by its April 2026 release. Its population and methodology differ from Hoxhunt’s. The two percentages should not be plotted as consecutive points on the same trend. [6]
1.07 million in Q2 2026
APWG recorded 1,069,681 attacks, up from 971,181 in Q1. Its main measure is unique reported phishing sites, not emails delivered or victims. This 10.1% quarterly rise does not measure AI use. [8]
Similar complaint counts. Much larger reported losses.
Complaints
Reported losses
IC3 also recorded 22,364 complaints with an AI related descriptor and $893.3 million in reported losses across crime types. That is a separate measure, not an amount to add to phishing losses. It includes more than $30 million associated with AI related business email compromise. The report describes generated executive messages and voice cloning among the techniques available to fraudsters. [7]
The strongest conclusion is narrower than “phishing is growing exponentially.” Personalization is easier to automate, and reported financial harm has increased. Neither a vendor’s AI classifier nor aggregate loss data can tell us how much of that harm automation caused.
Four patterns to test in your own processes
A video call that appears to confirm the email
Hong Kong authorities described a January 2024 fraud using a fabricated, prerecorded video conference. An employee authorized transfers to five accounts and the organization lost about HK$200 million. The official account establishes the mechanism without requiring speculation about the victim’s internal controls. [10]
The lesson is that a second medium is not necessarily independent verification. If the attacker supplies both the email and the meeting, the familiar face or voice adds persuasion without establishing authority. The Phish Scale covers email detection; it does not provide a validated score for a deepfake call.
A seasonal request that feels expected
Hoxhunt’s December jump occurred during the holiday period. NIST treats alignment with current events as part of the premise. A payroll deadline, travel booking or year-end supplier request is therefore a useful training scenario. The timing is consistent with that explanation, but it does not prove why the vendor’s observed share changed.
A conversation invented to make an invoice look routine
Fortra’s contribution to APWG’s Q2 report describes fabricated executive coaching invoice threads and two-step approaches where a business inquiry precedes the malicious link. Wire-transfer BEC volume in that dataset rose 88%, with an average requested amount of $61,732. These are attempted amounts and observed tactics, not evidence that those campaigns used AI. [8]
A first message can contain no link and still prepare the recipient for fraud. Test whether a new supplier, changed bank account or urgent exception bypasses the established approval process after a plausible conversation.
A voice that appears to authorize a payment
The FBI’s AI discussion reinforces the same boundary for phone calls. Call a number held in a trusted supplier or employee record. Do not use the number supplied in the request. For consequential transfers, require a second authorized approver and confirmation of the specific amount and destination.
When the reader is an AI agent
Email also reaches assistants that summarize messages, classify threats or call tools. CrowdStrike describes hidden instructions in phishing emails intended to mislead AI triage systems. That documents an attempted manipulation of the defender, not proof that every affected system complied. [11]
The human and agent risks differ. A person may be persuaded that a request is legitimate. A model may treat text inside a message as an instruction governing its own behavior. Email content must remain evidence to inspect, not authority to change the workflow.
The same request reaches two different decision makers
A familiar supplier name. A new payment destination.
The request looks credible
The employee recognizes the supplier and the business context.
The model extracts a change
Instructions inside the email may also try to redirect its tools.
Confirm with a known contact
Use the supplier record and the required approver, independently of the email.
Check the requested write
Enforce tool permissions outside the model. Reading mail does not authorize a bank change.
The bank record stays unchanged until approval is verified.
Reject the tool action and record the attempted change.
An assistant that only summarizes incoming mail should not inherit permission to edit suppliers or release payments. Where a workflow needs write access, validate the action, record and destination at the tool or application boundary. Keep the approval outside content supplied by the sender and preserve evidence of both rejected attempts and allowed actions.
Seven changes worth making
- Train on the decision. Use scenarios drawn from finance, recruiting, support and engineering. Ask what the request would change and who can approve it. Typos remain a clue, but their absence is not evidence of legitimacy.
- Rate simulations before comparing results. Apply the Phish Scale to the intended audience. Report difficulty, clicks, reporting rate and time to report together. A harder scenario can raise clicks without proving that training has deteriorated.
- Verify high impact requests independently. Set a documented path for payments, bank changes and account recovery. Use trusted contact details and a second approver where appropriate. Include urgent executive exceptions in exercises.
- Configure email protections and understand their limits. Inventory legitimate senders before moving DMARC toward enforcement. Add lookalike-domain monitoring and link inspection. DMARC helps against unauthorized use of your domain; it does not stop a lookalike domain, compromised mailbox or persuasive invoice.
- Use phishing-resistant authentication. Prioritize FIDO2/WebAuthn for email, administrators and financial systems. Review enrollment, recovery and weaker fallback methods. These controls resist credential phishing, but do not eliminate session theft or an already authorized user approving a fraudulent payment. [12]
- Make reporting quick and safe. Give staff a clear reporting route, acknowledge useful reports and define who can search for and contain related messages. Measure time to response. Blame after a click discourages early disclosure.
- Inventory agents that read external content. Record each assistant’s owner, mailbox access, tools and write permissions. Test whether a hostile email can alter triage, trigger forwarding or change a record. Inspect the action log, not only the model’s final response.
Start with one workflow and a measurable outcome
A startup can begin with supplier bank changes or account recovery. A larger organization can run the same exercise across business units, including outsourced support and delegated assistants. Use an agreed scope and synthetic records.
- Before the exercise
- Choose the audience, rate the lure and document the legitimate approval path. Identify any assistant that reads the mailbox.
- During the exercise
- Observe whether staff verify the destination through trusted records and whether an agent attempts a write outside its task.
- Evidence to keep
- The report time, verification steps, approval record and attempted tool calls. A synthetic supplier record must remain unchanged without valid approval.
- After the exercise
- Fix the failed step, assign an owner and repeat with a different plausible premise. Do not improve the score merely by making the email easier.
Where Oktsec fits
Our training for companies, governments and universities can connect phishing exercises to the decisions people make at work. A scoped assessment can examine the application permissions and agent actions behind that process.
Oktsec Control applies configured policies and content checks at routed enforcement points. It can help constrain tool use and identify known injection patterns. It does not replace email security, identity management or payment approval controls, and it cannot govern actions that bypass those enforcement points.
The useful test is whether a persuasive email can cause an unauthorized change. Establish that boundary for the employee and for every assistant acting alongside them.
Sources and scope
Reviewed October 18, 2026. This article analyzes published research and reports. The Phish Scale interpretation, workflow illustration and practical exercise are Oktsec’s analysis. Vendor samples, controlled click rates and reported financial losses are kept separate.
- NIST TN 2276: NIST Phish Scale User Guide (2023).
- Heiding et al.: Evaluating large language models’ ability to automate spear phishing (2026).
- Original study preprint (November 2024).
- IBM X-Force: AI vs. human deceit (2023).
- Hoxhunt: Phishing Trends Report 2026, including sampling methodology.
- KnowBe4: Phishing Threat Trends Report announcement (April 2026).
- FBI IC3: 2025 Internet Crime Report, pp. 25–26 and 39–40.
- APWG: Phishing Activity Trends Report, Q2 2026.
- Microsoft Digital Defense Report 2025.
- Hong Kong Government: Combating frauds involving deepfake (June 2024).
- CrowdStrike: AI monitoring and prompt injection against email triage.
- CISA: Implementing Phishing-Resistant MFA.