Topic starter
02/08/2026 11:45 am
TL;DR: AI-enabled phishing is rising sharply, including a 41% increase in teams-based attacks, a 449% surge in vishing, and a 92% jump in polymorphic attacks, according to KnowBe4 research. Human risk management, not awareness alone, is now the control gap that matters most.
Editorial analysis by NHI Mgmt Group, based on content published by Knowbe4: “Whitepapers and eBooks”.
Key questions
Q: What breaks when AI phishing is treated as only an email problem?
A: Teams miss the identity layer of the attack.
Q: Why do AI phishing attacks create more risk than traditional phishing?
A: AI lowers the cost, time, and skill needed to produce personalised lures, so attackers can run more campaigns and iterate faster.
Q: What are the signs that phishing-resistant controls are not being applied effectively?
A: A common warning sign is that users still authenticate with passwords, SMS codes, or push approvals for sensitive access while rare device registrations and unusual login events are not being reviewed.
Practitioner guidance
- Strengthen human risk telemetry Track repeated risky behaviours such as link clicks, credential submission, and approval of unexpected requests, then use those signals to target interventions and step-up controls.
- Expand verification beyond email Require secondary verification for money movement, password resets, and sensitive approvals when requests arrive through chat, voice, or collaboration tools.
- Instrument collaboration-channel trust paths Review how approval flows, file sharing, and delegated messaging work across Microsoft 365, Teams, and similar tools so phishing cannot hide inside legitimate workflows.
Bottom line: AI phishing is now a multi-channel trust problem, not just an inbox filtering problem.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 12:56 pm
Human risk management is now an identity governance issue, not just an awareness issue. AI phishing succeeds when organisations treat user judgment as the last line of defence rather than a governable control surface. The practical shift is toward measuring risky behaviour, enforcing step-up verification, and connecting human decisions to identity controls.
A question worth separating out:
Q: How should teams govern email and collaboration-channel trust together?
A: Teams should govern them as one trust path because attackers move between email, chat, and voice to find the weakest verification point. That means aligning email security, SSO safeguards, help-desk checks, and approval workflows around the same risk signals. The goal is to stop identity abuse wherever the request first appears.
👉 Read our full editorial: AI phishing and human risk are colliding with email security