AI-Generated Phishing Is Measurably Better — What the Research Actually Shows
Large language models remove the grammatical and cultural tells that used to make phishing easy to spot. Security awareness training built around those tells needs to change.
October 21, 2026
v1
2 min
AI-Generated Phishing Is Measurably Better — What the Research Actually Shows
Traditional phishing-detection advice leans heavily on spotting awkward grammar, unnatural phrasing, and generic greetings — tells that were reliable when phishing emails were mass-produced with minimal effort. Large language models remove most of those tells: an AI-generated phishing email can be grammatically flawless, personalized to the target's actual role and communication style, and written in fluent, idiomatic language regardless of the attacker's own native language.
What security-awareness training needs to change
- Shift training emphasis away from "look for bad grammar" toward verifying request legitimacy through an independent channel — a callback, a known internal process, a second approver.
- Treat urgency and financial/access requests as the actual red flag, not writing quality, since writing quality is no longer a reliable signal.
- Layer technical controls (email authentication — SPF/DKIM/DMARC, link/attachment sandboxing) more heavily, since the human-detection layer is measurably weaker against AI-generated content.
Related Executive Guides
One is a voluntary US risk-management framework; the other is a certifiable international management-system standard. Most serious AI governance programs end up using both.
Between the EU AI Act, ISO 42001, and enterprise-buyer security questionnaires that now include AI-specific sections, 'we don't have an AI governance program' is no longer a neutral answer.
Titles like 'Head of AI Governance' and 'AI Risk Officer' didn't exist five years ago. The role is still being defined, and it's landing in different places at different companies.