Topic starter
11/06/2026 11:15 pm
TL;DR: AI now generates 40% of phishing emails targeting businesses and can cut spam campaign costs by up to 95%, making attacks more personalized, scalable, and harder to catch according to JumpCloud and cited research. Old typo-based awareness training is no longer enough; organisations need request validation, layered identity controls, and stronger authentication gates.
Editorial analysis by NHI Mgmt Group, based on content published by JumpCloud: “Stop Guessing: 40% of All Phishing Emails Are Now AI-Generated”.
By the numbers:
- 40% of phishing emails targeting businesses are now generated by AI.
- AI can save spammers up to 95% in campaign costs.
Key questions
Q: How should security teams respond to AI-generated phishing campaigns?
A: Security teams should assume the message quality will be good enough to fool users and focus on reducing what a successful click can do.
Q: Why do AI-generated phishing attacks defeat traditional awareness training?
A: They remove the visual clues that old training relied on, such as spelling errors, odd domains, and obviously fake urgency.
Q: When does MFA matter most in a phishing attack?
A: MFA matters most when phishing reaches a login prompt or approval step.
Practitioner guidance
- Retrain users for request validation Replace typo-spotting exercises with drills that force staff to confirm the business request, sender intent, and payment or access context through a known alternate channel.
- Require phishing-resistant authentication Strengthen access flows so stolen passwords do not translate into immediate account access, especially for email, help desk, finance, and admin accounts.
- Test executive and vendor impersonation scenarios Use simulations that mirror AI-generated messages from leadership, suppliers, and internal approvers so detection practice matches the current threat shape.
Bottom line: AI-generated phishing weakens awareness models that depend on spotting obvious language mistakes and generic templates.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
12/06/2026 7:51 am
AI-generated phishing is a human trust problem, not a wording problem. The old assumption was that phishing could be exposed by poor language, spelling, or generic templates. That assumption fails when an LLM can generate fluent, context-aware messages at scale. The implication is that human identity programmes must move from message inspection to request validation.
A few things that frame the scale:
- Roughly 1 in 3 phishing payloads are delivered outside email, through channels such as social media, search ads and messaging apps.
A question worth separating out:
Q: How can organisations verify urgent requests without slowing operations too much?
A: Define a small set of high-risk actions that always require out-of-band confirmation, such as credential resets, payment changes, new device enrolment, and privileged access requests. That keeps friction focused on the actions most likely to be abused.
👉 Read our full editorial: AI-generated phishing is breaking old human training models
This post was modified 4 days ago by NHI Mgmt Group