AI-powered phishing is still driving the costliest breaches

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Abnormal AI's blog post: Phishing is still the leading breach entry point, and AI now lets attackers create convincing lures in minutes rather than hours.

Why it matters: It matters because identity teams now have to detect behavioural anomalies across email, vendor relationships, and account activity, not just block suspicious messages at the perimeter.

By the numbers:

• Phishing again accounts for 16% of incidents analyzed and averages 254 days to detect and contain.
• Generative AI reduced the time to write a convincing phishing email from 16 hours to just 5 minutes.
• Organizations that used AI and automation extensively reduced breach costs by nearly $1.9 million and contained incidents 80 days faster.
• Breaches identified and contained in under 200 days averaged $3.87 million, while those lasting longer cost $5.01 million.

Context

Phishing remains the breach path that most security programmes still underestimate because it exploits trust, not just technical misconfiguration. In identity terms, the initial compromise often becomes more dangerous once the message reaches a human with access to business systems, vendors, or payment workflows.

Abnormal AI frames the problem through IBM's 2025 breach data: phishing has returned as the leading entry point, while vendor impersonation and account takeover magnify impact and delay containment. The central issue is not email alone, but how quickly a social-engineering event becomes an identity and access event.

For IAM and NHI teams, this is a governance problem as much as a detection problem. The same breach pattern exposes weak behavioural controls around human accounts, third-party access, and the handoff from inbox to privileged workflow.

Key questions

Q: Why do AI-generated phishing attacks defeat traditional awareness training?

A: They remove the visual clues that old training relied on, such as spelling errors, odd domains, and obviously fake urgency. When a message mirrors a real role, vendor, or workflow, employees are less likely to question it. That makes context, not just content, the deciding factor in whether the attack succeeds.

Q: When do vendor impersonation and account takeover become the biggest breach risk?

A: They become highest risk when trusted relationships are allowed to operate without a second trust check. A familiar sender, expected document, or routine payment request can still be hostile if the identity behind it is compromised. The danger grows when business processes treat recognisable communication as proof of legitimacy.

Q: What are the signs that a phishing investigation process is failing?

A: A failing phishing process usually shows up as long triage times, heavy portal switching, inconsistent verdicts, and backlog growth faster than analysts can clear it. Another warning sign is overreliance on reputation checks alone, which misses targeted attacks using fresh domains or URLs. If analysts cannot trace every conclusion to evidence, the process is too fragile for reliable response.

Q: How should security teams reduce the cost of phishing-related breaches?

A: By shortening the time between initial contact, investigation, and containment. The article shows that cost rises sharply as breaches linger, so teams should prioritise fast isolation of suspicious accounts, stronger vendor verification, and detection methods that can correlate email activity with identity and transaction changes.

Technical breakdown

Why AI-assisted phishing scales faster than static filtering

Generative AI changes phishing from a handcrafted social-engineering effort into a high-volume content production problem. The attacker no longer needs hours to draft a convincing message, and that reduction in production time increases both message volume and personalisation. Static filtering is weak against this because the content itself may not look obviously malicious, especially when the lure borrows legitimate tone, context, and vendor language. The real technical shift is that the detection surface moves from syntax to behaviour, timing, and relationship anomalies across messages and follow-on actions.

Practical implication: move detection from message matching to behavioural correlation across sender history, conversation context, and post-click account activity.

Why vendor compromise and account takeover extend breach duration

Vendor compromise and account takeover are costly because they blend into expected business relationships. A malicious actor impersonating a trusted vendor can reuse routine document flows, payment requests, and account interactions long enough to avoid suspicion. Once a credentialed identity is involved, the security problem shifts from email ingress to authorised misuse, and that usually delays triage. The attack is not only about the initial message but about how long the compromised relationship remains believable inside business processes.

Practical implication: correlate vendor communications with identity signals and transaction changes so routine-looking requests are not treated as trusted by default.

Why breach cost tracks containment time so closely

The report shows a strong time-to-cost relationship because every extra day expands the attacker's opportunity to move from inbox access to wider operational impact. Once the breach persists beyond 200 days, the cost penalty rises sharply because forensic scope, business disruption, and response overhead all grow together. This is especially relevant where the first sign comes from the attacker rather than internal detection, because by then the defender has already lost the initiative. Time is not just a metric here; it is a multiplier on damage.

Practical implication: treat fast containment as a cost-control objective and measure detection pathways by how quickly they shorten exposure, not only by alert volume.

Threat narrative

Attacker objective: The attacker aims to turn a believable message into trusted access that can be converted into fraud, account takeover, or broader breach impact.

1. Entry begins with AI-generated phishing delivered by email, where the lure is personalised enough to bypass weak content-based controls and prompt a user action.
2. Credential or workflow abuse follows when the victim clicks, responds, or authorises a request that gives the attacker access to an inbox, vendor process, or account.
3. Escalation occurs when the compromised identity is used to alter payments, impersonate a trusted party, or extend access into related systems and conversations.
4. Impact is measured in breach cost and containment time, which grow as the attacker remains embedded in ordinary business communications.

Breaches seen in the wild

• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Behaviour, not message content, is now the decisive control plane for phishing defense: AI has made lure creation cheap, fast, and highly personalised, which means the old assumption that malicious email will look malformed or generic no longer holds. Defenders who still rely on static filtering are optimising for the wrong layer of the problem. The practical implication is that email defence must be evaluated by its ability to spot abnormal intent and follow-on behaviour, not just suspicious wording.

Vendor compromise is an identity problem disguised as an email problem: The article shows that routine-looking third-party interactions can carry the highest breach costs because trust in the relationship outlives the actual legitimacy of the request. Once identity is treated as a sufficient trust signal, attackers can hide inside normal workflows for months. Security teams should treat third-party communication patterns as part of IAM governance, not only as messaging hygiene.

Time-to-containment is the real economic control variable: The gap between incidents closed under 200 days and those that linger beyond that threshold shows that detection latency directly drives financial loss. That makes behavioural telemetry and rapid triage more valuable than another layer of point controls. Practitioners should measure control effectiveness by how much exposure time they remove from the attack path.

AI adoption by defenders is now a cost-containment strategy, not an innovation narrative: The reported $1.9 million cost reduction and 80-day containment improvement show that AI matters when it is embedded in detection, investigation, and response loops. The market signal is clear: security programmes that cannot reason over relationships, context, and intent will keep losing ground to AI-accelerated phishing. The implication for practitioners is to prioritise behavioural analytics where identity and communication intersect.

AI-powered phishing creates an inbox-to-identity blast radius: That is the right name for the problem this article surfaces. The danger is not just inbox compromise but the way a single message can cascade into account takeover, vendor misuse, and payment manipulation before human review catches up. Teams should govern that blast radius explicitly across email, IAM, and third-party access.

From our research library:

• 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
• Organisations with high levels of shadow AI faced an average of $670,000 in additional breach costs compared with those with little or none, according to IBM's 2025 Cost of a Data Breach Report.
• Read next: AI Agent Observability, Audit and Incident Response Guide

What this signals

Inbox compromise now functions as an identity governance event: The practical boundary has moved beyond spam filtering into account state, vendor trust, and workflow integrity. Programmes that still separate email security from IAM will miss the point where a message turns into an access decision.

AI-powered phishing widens the gap between detection speed and attack speed: The attacker can now create convincing content in minutes, which compresses defender reaction time and makes manual review a losing strategy. Behavioural analytics and automated containment become the only realistic way to keep pace.

Behavioural intelligence is the control plane that joins human, vendor, and machine trust: Phishing succeeds when those trust layers are treated separately. Security teams should expect more attacks that begin in the inbox but are designed to exploit identity workflows across finance, support, and administration.

For practitioners

• Tighten behavioural detection on email and vendor workflows Correlate sender history, conversation context, payment changes, and post-click identity activity so a believable message is not treated as trustworthy by default.
• Instrument third-party access as an identity signal Track vendor account usage, request patterns, and transaction changes together so routine-looking supplier contact cannot silently become a breach path.
• Reduce exposure windows with faster containment playbooks Define escalation paths that isolate inboxes, revoke suspicious sessions, and validate vendor requests before the attacker can extend the compromise into finance or admin workflows.
• Measure controls by time saved in investigation Use containment duration, not just alert counts, to judge whether detection and response are actually shrinking the breach window.
• Govern human and machine trust boundaries together Review whether email-derived requests can trigger privileged actions without a second trust check, especially where humans, vendor identities, and automation intersect.

Key takeaways

• Phishing remains a primary breach entry path because AI now lets attackers personalise at scale and move faster than traditional content filters can respond.
• The cost problem is a time problem as well, because breaches that persist longer drive materially higher losses and deeper operational disruption.
• Defenders need behavioural correlation across email, identity, and vendor activity if they want to reduce both compromise rates and containment time.

Key terms

• Behavioural email detection: A detection approach that looks for patterns in sender behaviour, message timing, language change, and downstream user interaction rather than relying only on signatures. It is designed to catch attacks that mutate quickly. For identity programmes, its value is in finding the moment an email becomes an access risk.
• Account Takeover: Account takeover is unauthorized use of a legitimate account after an attacker obtains valid access through stolen credentials, tokens, or trusted integrations. The key security problem is that the resulting activity often looks normal to logs and controls, which makes containment and attribution harder than in a forced-entry breach.
• Vendor Impersonation: Vendor impersonation is a fraud pattern where an attacker or dishonest actor pretends to be a supplier in order to change payment details or redirect funds. The control weakness is usually weak verification, not just a bad email, because the organisation failed to confirm the change through a trusted channel.
• Containment Time: Containment time is the period between detecting a security incident and limiting its spread or impact. Shorter containment time generally reduces the number of affected systems, the volume of data exposed, and the cost of recovery. It is a practical measure of how effectively detection and response processes are working.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.