Topic starter
02/08/2026 12:08 pm
TL;DR: Cybercriminals are using AI to scale polymorphic attacks, evade Microsoft native security and secure email gateways by 47%, and drive ransomware resurgence through phishing, according to Knowbe4’s 2025 Phishing Threat Trends Report. The control gap is no longer email filtering alone, but behavioural detection, identity hardening, and rapid response to credential theft.
Editorial analysis by NHI Mgmt Group, based on content published by Knowbe4: “2025 Phishing Threat Trends Report, Vol. 5”.
By the numbers:
- Cybercriminals have achieved a 47% increase in attacks evading Microsoft’s native security and secure email gateways.
- 92% of polymorphic attacks utilize AI to achieve unprecedented scale.
Key questions
Q: What breaks when phishing campaigns are generated and iterated by AI?
A: What breaks is the assumption that phishing is slow, manual, and easy to profile.
Q: Why do AI-assisted phishing and credential theft increase ransomware risk?
A: AI can improve targeting, language quality, and volume, which raises the success rate of social engineering and credential collection.
Q: What are the signs that email-only defences are no longer enough?
A: The clearest signs are rising message evasion, repeated user-reported phish that pass gateway controls, and suspicious account activity after delivery.
Practitioner guidance
- Harden identity controls for phished accounts Require phishing-resistant MFA for high-risk users and monitor for impossible travel, token abuse, and anomalous consent events after suspicious messages are reported.
- Add behavioural detections to inbox filtering Correlate sender reputation, message intent, and post-delivery user behaviour so campaign variation does not bypass static email rules.
- Shorten containment steps for credential theft Automate session revocation, password reset, and token invalidation for accounts exposed through phishing to limit lateral movement and ransomware staging.
Bottom line: AI is making phishing campaigns more adaptive, which weakens controls that depend on fixed patterns or static signatures.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:12 pm
AI-driven phishing is now an identity governance problem, not just an email-security problem. The report shows attackers using AI to scale lures, evade filtering, and keep phishing economically viable. That means the control boundary has shifted from message reputation to trust validation, account protection, and response speed. Practitioners should treat every successful phish as an identity event that can cascade into credential abuse.
A few things that frame the scale:
- The IBM/Ponemon 2025 Cost of a Data Breach Report found that phishing-initiated breaches cost an average of $4.8M each.
A question worth separating out:
Q: When should organisations prioritise phishing resistant access over more awareness training?
A: Organisations should prioritise phishing resistant access when the environment already has SSO, MFA, and frequent remote access, yet attacks still succeed. That pattern shows the weak point is authentication assurance, not user knowledge. Training remains useful, but it should support controls that reduce the chance of stolen credentials becoming usable access.
👉 Read our full editorial: Phishing threat trends show AI-driven evasion is scaling fast