Topic starter
11/11/2026 6:04 pm
TL;DR: Phishing protection now has to govern the external discovery layer, not just the inbox or the browser, as 38% of surveyed U.S. consumers had already used generative AI for online shopping and 52% planned to do so in 2026, according to BrandShield and Adobe Digital Insights. Phishing protection now has to govern the external discovery layer, not just the inbox or the browser.
Editorial analysis by NHI Mgmt Group, based on content published by BrandShield: “The Next Phishing Site May Be Recommended by AI”.
By the numbers:
- 38% of surveyed U.S. consumers had already used generative AI for online shopping.
- 52% said they planned to use generative AI for online shopping in 2026.
Key questions
Q: Why do generative AI tools make phishing and password attacks more effective?
A: Generative AI lowers the cost of producing believable lures at volume.
Q: What is the best way to investigate a phishing campaign across domains?
A: Investigate it by correlating email headers, sender infrastructure, URLs, certificates, DNS, hosting, and web content, then cluster related domains by shared registration data, redirect chains, and reused assets.
Q: How do phishing sites appear in AI search results?
A: Phishing sites can appear when an AI assistant retrieves or summarises public web content that looks relevant to a user’s request.
Practitioner guidance
- Expand external monitoring to AI discovery paths Track how brand, product and store pages appear in AI-generated responses as well as in search, social media, marketplaces and ads.
- Cluster related phishing assets into campaigns Correlate domains, page copies, hosting patterns, analytics identifiers and account reuse to identify one operator behind many assets.
- Prioritise active exposure over dormant lookalikes Escalate phishing pages that users can currently reach or that appear in AI recommendations before older, inactive clones.
Bottom line: Phishing protection now has to account for AI-assisted discovery, because fraudulent sites can reach users through recommendation surfaces as well as email and search.
Glossary terms: Phishing, Lookalike Domain, Brand Impersonation, Threat Clustering
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/11/2026 6:07 pm
Phishing is becoming a discovery problem, not just a delivery problem. The control boundary has moved upstream into the places where users first encounter brands, products and offers. If the malicious source is surfaced by search, social channels or AI assistants before the victim visits the site, then inbox filtering alone cannot govern exposure. Organisations need visibility into the external environment that shapes trust decisions, not just into messages that arrive in corporate mailboxes.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: When should teams prioritise takedown over detection alerts?
A: Prioritise takedown when the campaign is active, the infrastructure is reusable, and the same domain or host is serving many victims, because removing it can stop delivery faster than alerts alone. Detection alerts should lead when you need immediate containment, but takedown is the stronger option when an exposed phishing site, redirector, or malicious mailbox remains reachable.
👉 Read our full editorial: AI shopping recommendations expand phishing risk beyond email