Why do we keep testing employees for yesterday’s phishing attacks

Publisher excerpt From CSO Online

“Yesterday’s price is not today’s price,” a phrase Fat Joe popularized in 2021, reminds us that what worked yesterday may not deliver the same value today. In cybersecurity, this matters when we continue to assess employees against familiar phishing techniques while attackers use AI to craft more convincing, personalized messages. Having conducted multiple phishing simulations and one in October, 2026, I believe we need to ask a harder question: are we preparing people for the phishing attacks they are likely to face today, or testing their ability to recognize or remember the warning signs we have taught them to expect? What happens when those warning signs don’t apply or they face novel attacks? AI -enabled “phishing landscape” The traditional tell-tale signs of phishing which we used to train employees for are becoming less dependable. Generative AI can help attackers produce convincing messages, personalize lures and improve the quality of their communication. This does not mean every phishing campaign uses AI in reality, but it raises the bar for what employees may encounter. A 2025 report by SC Media covering Egress research found that 75% of the phishing kits examined on dark-web markets advertised AI capabilities, while 82% offered deepfake features. These figures relate to the kits analyzed, rather than all phishing activity, but they show that AI-enabled features are appearing in tools available to criminals. Add this to the spike in recent phishing attacks wit…

Excerpt only, shown with attribution. This content belongs to the original publisher and has not been independently verified by CyberSecurity.pk.