Threat Intelligence · 2 min read
AI-Generated Phishing Is Measurably Better — What the Research Actually Shows
Large language models remove the grammatical and cultural tells that used to make phishing easy to spot. Security awareness training built around those tells needs to change.
Traditional phishing-detection advice leans heavily on spotting awkward grammar, unnatural phrasing, and generic greetings — tells that were reliable when phishing emails were mass-produced with minimal effort. Large language models remove most of those tells: an AI-generated phishing email can be grammatically flawless, personalized to the target's actual role and communication style, and written in fluent, idiomatic language regardless of the attacker's own native language.
What security-awareness training needs to change
- Shift training emphasis away from "look for bad grammar" toward verifying request legitimacy through an independent channel — a callback, a known internal process, a second approver.
- Treat urgency and financial/access requests as the actual red flag, not writing quality, since writing quality is no longer a reliable signal.
- Layer technical controls (email authentication — SPF/DKIM/DMARC, link/attachment sandboxing) more heavily, since the human-detection layer is measurably weaker against AI-generated content.