Topic starter
02/08/2026 11:34 am
TL;DR: AI has accelerated phishing by helping attackers bypass native defenses and secure email gateways, while Knowbe4 cites an average of 21 seconds to click a phishing link, 52% growth in attacks getting through SEGs, and 19% of phishes relying solely on social engineering. The practical issue is not just more volume, but faster credential capture that outpaces human review and conventional email controls.
Editorial analysis by NHI Mgmt Group, based on content published by Knowbe4: “CISO Strategy Guide: Social Engineering in the Age of AI”.
By the numbers:
- It only takes an average of 21 seconds for someone to click on a phishing link.
- It takes a further 28 seconds for them to enter their credentials.
- The guide says there has been a 52% increase in attacks getting through secure email gateways.
Key questions
Q: What happens when AI-enhanced phishing reaches users before email security can analyze it?
A: When AI enhanced phishing reaches users first, the attack can escalate into invoice fraud, account compromise, or business email compromise before defenders react.
Q: Why do stolen employee credentials create such a high detection risk for identity teams?
A: Stolen credentials are dangerous because they let attackers look like legitimate users, which makes simple login activity harder to flag as malicious.
Q: How can teams tell whether phishing controls are actually working?
A: Look for fewer successful credential submissions on lookalike domains, lower password reuse, and faster reporting of suspicious messages.
Practitioner guidance
- Tighten authentication after suspicious email activity Use conditional access, step-up checks, and risk-based authentication when a user clicks from a suspicious message or lands on a credential prompt.
- Harden Microsoft 365 against credential replay Review mailbox access, session persistence, and connected application grants so a stolen password cannot immediately become broad account reach.
- Reduce exposure from email-based trust decisions Train users on verification for login prompts, payment requests, and approval workflows, especially when the message creates urgency or secrecy.
Bottom line: AI-assisted phishing is shrinking the gap between message delivery and credential theft, which makes traditional user vigilance an incomplete control.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 12:48 pm
AI has compressed the credential theft window into an identity governance problem. When a phishing click happens in 21 seconds and credentials follow 28 seconds later, the control failure is not merely user caution. The real issue is that traditional detection and review cycles are slower than the attack lifecycle. Identity teams should treat phishing as an authentication-path risk, not only an email-filtering problem.
A question worth separating out:
Q: Should organisations prioritise email filtering or identity controls against AI phishing?
A: Identity controls should be prioritised when the threat is credential theft, because filtering cannot stop every lure and AI makes message quality easier to scale. Email controls still matter, but the decisive layer is the one that governs authentication, step-up verification, and rapid session revocation after a suspicious interaction. That is where the attacker value is realised or denied.
👉 Read our full editorial: AI-driven phishing is compressing the credential theft window