Topic starter
02/08/2026 12:08 pm
TL;DR: 47% higher evasion shows AI-driven phishing is scaling past Microsoft native security and secure email gateways, in Knowbe4’s 2025 Phishing Threat Trends Report. Identity controls now have to absorb more adaptive lures and faster credential theft.
Editorial analysis by NHI Mgmt Group, based on content published by Knowbe4: “2025 Phishing Threat Trends Report, Vol. 5”.
By the numbers:
- Cybercriminals have achieved a 47% increase in attacks evading Microsoft’s native security and secure email gateways.
- 92% of polymorphic attacks utilize AI to achieve unprecedented scale.
Key questions
Q: Why do AI-assisted phishing and credential theft increase ransomware risk?
A: AI can improve targeting, language quality, and volume, which raises the success rate of social engineering and credential collection.
Q: What are the signs that email-only defences are no longer enough?
A: The clearest signs are rising message evasion, repeated user-reported phish that pass gateway controls, and suspicious account activity after delivery.
Q: What breaks when phishing campaigns are generated and iterated by AI?
A: What breaks is the assumption that phishing is slow, manual, and easy to profile.
Practitioner guidance
- Harden identity controls for phished accounts Require phishing-resistant MFA for high-risk users and monitor for impossible travel, token abuse, and anomalous consent events after suspicious messages are reported.
- Add behavioural detections to inbox filtering Correlate sender reputation, message intent, and post-delivery user behaviour so campaign variation does not bypass static email rules.
- Shorten containment steps for credential theft Automate session revocation, password reset, and token invalidation for accounts exposed through phishing to limit lateral movement and ransomware staging.
Bottom line: AI is making phishing campaigns more adaptive, which weakens controls that depend on fixed patterns or static signatures.
Glossary terms: Polymorphic phishing, Phishing Detection Evasion, Identity Hardening, Session revocation
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 days ago by NHI Mgmt Group
02/08/2026 1:12 pm
AI-driven phishing is now an identity governance problem, not just an email-security problem. The report shows attackers using AI to scale lures, evade filtering, and keep phishing economically viable. That means the control boundary has shifted from message reputation to trust validation, account protection, and response speed. Practitioners should treat every successful phish as an identity event that can cascade into credential abuse.
A few things that frame the scale:
- The IBM/Ponemon 2025 Cost of a Data Breach Report found that phishing-initiated breaches cost an average of $4.8M each.
A question worth separating out:
Q: When should organisations prioritise phishing resistant access over more awareness training?
A: Organisations should prioritise phishing resistant access when the environment already has SSO, MFA, and frequent remote access, yet attacks still succeed. That pattern shows the weak point is authentication assurance, not user knowledge. Training remains useful, but it should support controls that reduce the chance of stolen credentials becoming usable access.
👉 Read our full editorial: Phishing threat trends show AI-driven evasion is scaling fast