“Yesterday’s price is not today’s price,” a phrase Fat Joe popularized in 2021, reminds us that what worked yesterday may not deliver the same value today.
In cybersecurity, this matters when we continue to assess employees against familiar phishing techniques while attackers use AI to craft more convincing, personalized messages. Having conducted multiple phishing simulations and one in October, 2026, I believe we need to ask a harder question: are we preparing people for the phishing attacks they are likely to face today, or testing their ability to recognize or remember the warning signs we have taught them to expect? What happens when those warning signs don’t apply or they face novel attacks?
AI -enabled “phishing landscape”
The traditional tell-tale signs of phishing which we used to train employees for are becoming less dependable. Generative AI can help attackers produce convincing messages, personalize lures and improve the quality of their communication. This does not mean every phishing campaign uses AI in reality, but it raises the bar for what employees may encounter.
A 2025 report by SC Media covering Egress research found that 75% of the phishing kits examined on dark-web markets advertised AI capabilities, while 82% offered deepfake features. These figures relate to the kits analyzed, rather than all phishing activity, but they show that AI-enabled features are appearing in tools available to criminals. Add this to the spike in recent phishing attacks with AI prompt injections and you realize quickly the landscape has morphed.
This matters for awareness programs. If employees are mainly taught to look for spelling mistakes, generic greetings or suspicious formatting, they may be less prepared for a message that uses familiar names, relevant business context and professional language when attackers use AI to craft them. Training needs to emphasize verification in addition to simply recognition and unexpected requests should be checked through a trusted channel, even when the message appears legitimate.
Click rates are not everything
Phishing simulations often produce a straightforward headline and statistics: the percentage of recipients who clicked a link, entered credentials and deleted or reported the message. They are easy metrics to communicate, compare and track over time and also to present to Senior Management in meetings but it provides only one part of the picture.
Imagine two groups with the same click rate. In one, employees who suspect a message report it quickly, allowing the security team to investigate, detect other people who may have received it and warn other recipients. In the other, people delete the message or ignore it without reporting it. The click rates may look identical, but the organization’s ability to detect a real campaign is different.
Reporting rates and time to report therefore deserve more attention. Security teams should understand whether employees use the approved reporting channel, how quickly suspicious messages reach analysts and whether those reports lead to effective action. The National Cyber Security Centre’s guidance on phishing provides practical advice on recognizing and reporting suspicious messages and organizations should have this on their website or HR portals.
As I have seen in multiple simulations I have conducted, results also need careful interpretation. A test is a controlled exercise, not a guarantee of how someone will behave during a real attack, which could depend on the recipient’s state of mind. Employees may recognize familiar templates or learn the patterns used in repeated campaigns. Clicking a simulated link also does not automatically mean someone would compromise the organization in a real incident.
The objective should be to identify weaknesses and improve security, not to rank employees by how often they pass or fail, and this should reflect in the way messages about failure are passed on.
Test the response and the person
Phishing simulations should evolve alongside the threats they are intended to represent. Scenarios should reflect realistic business situations, including unexpected document sharing, supplier requests and attempts to impersonate trusted colleagues instead of clicking links or supplying credentials only. Employees should learn how to verify unusual requests and report suspected attacks without fear of embarrassment or punishment. From experience, this may have many moving parts, like custom mailboxes, a departure from the simulation norm and multiple levels of approval before exercises like this can be done but it’s worth the effort.
Security teams should also evaluate what happens after a suspicious message arrives. How quickly is it reported? Can analysts identify and contact other recipients who possibly responded to the message? Can the organization remove the message from inboxes, block malicious infrastructure and investigate potential account compromise? These questions connect awareness testing to operational readiness.
The same principle applies to incident exercises. Security, IT, finance and relevant business teams should know what to do when a real phishing attack succeeds, which it inevitably will, someday. A program that improves reporting and response can deliver value even when it cannot prevent every employee from clicking.
AI will continue to change how phishing messages are created and delivered and security awareness must change with it. The question is whether the organization can verify suspicious activity, detect an attack and limit its impact when the message looks entirely legitimate and is prone to being clicked as a result.
Yesterday’s tests can still teach useful lessons but should not define tomorrow’s readiness.
No Responses