AI and crowdsourced intelligence are reshaping phishing defense

At a glance

What this is: Knowbe4’s whitepaper says phishing defense needs AI plus crowdsourced user intelligence because purely technical controls are not keeping pace with phishing and spear phishing.

Why it matters: This matters to IAM and security teams because phishing is still a primary path into identity compromise, and detection improves when user reporting, telemetry, and response are governed together.

Context

Phishing defence fails when security teams treat it as a filtering problem instead of an identity and trust problem. Attackers exploit human judgement, then use the resulting trust breach to reach credentials, sessions, or downstream systems, which means control effectiveness depends on how quickly suspicious activity is surfaced and acted on.

The whitepaper’s central claim is that AI and crowdsourced intelligence improve phishing mitigation when they are combined into a single operating model. That is relevant to IAM because the same reporting, triage, and escalation processes that help spot phishing also support identity verification, account protection, and faster containment of compromised users.

Key questions

Q: How should security teams combine user reporting and AI for phishing defence?

A: Use AI to cluster and prioritise suspicious messages, then use user reports to add context that automated tools often miss. The strongest approach is a single workflow where reports, model output, and analyst review feed one containment decision. That reduces delay, improves campaign detection, and keeps response tied to identity and account risk.

Q: Why do phishing and vishing attacks remain effective in organisations with strong technical controls?

A: They remain effective because attackers exploit human psychology, especially urgency, fear, and trust. Even well-filtered messages can succeed if the target is under pressure or sees the request as routine. When privileged users are involved, a single mistake can bypass layered defenses. Organisations should prioritize role-based risk analysis, not just generic awareness, to reduce exposure.

Q: What are the main failure modes in phishing defence programmes?

A: The common failures are slow triage, disconnected reporting channels, and response processes that stop at email blocking. If a suspicious message is reported but not tied to identity actions such as credential reset or session revocation, the programme detects risk without containing it. That leaves the attacker room to reuse the trust breach.

Q: How should teams respond when phishing may have exposed an account?

A: Contain the identity first. Reset credentials where needed, revoke active sessions, review MFA status, and check privileged entitlements before assuming the message was harmless. If the account belongs to a sensitive user or admin, prioritise rapid investigation of sign-in history and any downstream access that may already have occurred.

Technical breakdown

Why technical filters alone miss modern phishing campaigns

Traditional phishing controls focus on blocking known bad content, domains, or links. That works for obvious attacks, but spear phishing is designed to look legitimate, vary quickly, and exploit context that static rules do not understand. AI can help by ranking signals across message content, sender patterns, and behavioural anomalies, but it only improves outcomes when the underlying data is fed into an operating process that can learn from new abuse patterns. The governance gap is not detection technology alone, it is the ability to convert weak signals into timely decision-making.

Practical implication: route phishing signals into a feedback loop that updates detection logic and response priority fast.

How crowdsourced intelligence changes phishing detection

Crowdsourced intelligence adds human context that automated controls often miss. Users can report suspicious messages, unusual requests, or social engineering cues that never appear in reputation feeds or signature libraries. That does not replace technical controls, it extends them by giving the security team a broader view of what is reaching people in the organisation. The value is highest when user reports are triaged, correlated, and used to improve detection rules rather than sitting as isolated inbox noise.

Practical implication: give users a low-friction reporting path and treat reports as operational threat intelligence, not admin spam.

Why phishing defence is an identity governance issue

Phishing rarely ends with the email itself. The real risk is credential capture, session theft, or fraudulent account activity that can move into IAM and PAM pathways. Once a user is tricked, the organisation needs to know whether to revoke tokens, reset credentials, step up authentication, or investigate suspicious access. That makes phishing defence part of identity governance, because the response must link detection, authentication, and account recovery. AI and crowdsourcing help only if they shorten the time between suspicion and control action.

Practical implication: connect phishing reporting to identity response playbooks that cover credential reset, session invalidation, and access review.

Threat narrative

Attacker objective: The attacker wants user trust to convert into account access that can be reused for fraud, persistence, or secondary compromise.

1. Entry occurs through a phishing or spear phishing message that looks credible enough to prompt a user response.
2. Credential harvest follows when the target enters secrets, approves a malicious prompt, or exposes account access through the lure.
3. Impact is account compromise or broader identity abuse, which can then be used for fraud, lateral access, or further phishing from trusted accounts.

Breaches seen in the wild

• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
• Solana web3.js npm compromise 2024: A phished maintainer's npm access let attackers publish two @solana/web3.js versions that stole private keys from bots and apps.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Phishing defence is becoming an intelligence fusion problem, not a filter tuning problem. Static controls will always lag campaigns that mutate copy, infrastructure, and delivery paths. The practical shift is toward combining machine detection, user reporting, and triage workflows into one control surface so weak signals become actionable sooner.

Crowdsourced reporting matters because users often see the first trustworthy signal. Technical platforms may catch known indicators, but people often recognise suspicious context before a rule fires. That makes human reporting a control input, not a soft awareness metric, and it should be treated as part of security operations rather than as an adjacent training programme.

Phishing now sits inside identity governance, not just email security. Once a lure succeeds, the next decisions involve authentication resets, session revocation, privilege review, and account recovery. That intersection means IAM, SOC, and user reporting processes need shared escalation paths, or the organisation ends up detecting attacks faster than it can contain identity abuse.

Proactive defence is now the baseline expectation for phishing programmes. Waiting for confirmed compromise leaves too much exposure between initial contact and containment. Organisations should assume that user trust, not message content alone, is the attacker’s target, and build controls that turn early suspicion into measurable response speed.

Human intelligence closes the gap that AI alone cannot. AI can rank patterns at scale, but it still benefits from feedback that reflects business context, role-based nuance, and emerging lures. The stronger programme is the one that learns from user signals continuously and turns them into faster decisions for security and identity teams.

From our research library:

• The IBM/Ponemon 2025 Cost of a Data Breach Report found that phishing-initiated breaches cost an average of $4.8M each.

What this signals

Phishing programmes are moving from static blocking to adaptive intelligence. The practical question is no longer whether an email filter catches a lure, but whether the organisation can learn from every suspicious message fast enough to improve the next decision.

User reporting becomes more valuable when it is operationalised. If reports flow into triage, identity response, and detection tuning, they become part of the control stack rather than a culture exercise.

The governance challenge is cross-functional. Email security, IAM, and SOC workflows need shared handoffs because successful phishing often becomes an identity event before it becomes a malware event.

For practitioners

• Build a phishing intelligence feedback loop Connect user reports, email telemetry, and analyst triage so each confirmed phish improves detection logic and response prioritisation.
• Make user reporting a security control Provide a simple reporting path in mail and collaboration tools, then define service levels for review, escalation, and closure.
• Tie phishing alerts to identity response Link high-confidence phishing events to credential reset, session invalidation, and access review playbooks for impacted accounts.
• Use AI to prioritise suspicious messages Score messages by content, sender behaviour, and organisational context so analysts spend time on likely spear phishing rather than bulk noise.

Key takeaways

• Phishing defence is weakening where organisations rely on filters without a feedback loop that learns from user-reported suspicious activity.
• The article’s core argument is that AI works best when it is paired with crowdsourced intelligence and triaged as part of one operating model.
• For practitioners, the control question is how quickly a suspicious message becomes identity action, not how many messages the gateway blocks.

Key terms

• Phishing Defense: Phishing defense is the set of controls and operating practices used to detect, disrupt, and respond to fraudulent messages that try to trick users into unsafe action. It combines filtering, investigation, user reporting, and response workflows. Strong phishing defense reduces dwell time and limits the chance that human error turns into compromise.
• Crowdsourced Threat Intelligence: Crowdsourced threat intelligence is operational security signal collected from many users or observers and turned into structured detection input. In phishing defence, it usually means employee reports and comments are triaged alongside automated alerts to identify campaigns faster and improve response quality.
• Spear Phishing: Spear phishing is a targeted social engineering attack designed to persuade a specific person or group to reveal credentials, approve access, or run malicious content. It differs from broad spam because the message is tailored to the target’s role, tools, or business context.
• Identity Response: Identity response is the operational act of changing access because risk has been detected. It moves beyond logging or alerting and into suspension, restoration, revocation, or step-up enforcement, with the goal of containing exposure while preserving traceability and governance.

Deepen your knowledge

The NHI Foundation Level course covers NHI governance, machine identity security, and identity lifecycle controls through the industry's only accredited NHI security programme. It helps security and IAM practitioners connect identity governance to the operational decisions their programmes depend on.