Don’t Take the Bait: Defending Against AI-Driven Phishing

In Part 1, “The Bait Got Better: How AI Is Changing Phishing,” we looked at how AI is making phishing more personalized, convincing, and easier to scale. If the traditional signs of phishing are becoming harder to spot, the way organizations defend against it also needs to change.

Most organizations respond to better phishing by running more phishing simulations. That is a reasonable instinct, but an insufficient one. When attackers can create polished, well-researched, highly personalized messages at minimal cost, and potentially reinforce them through convincing voice or video impersonation, relying on an employee to recognize that something “looks wrong” becomes increasingly risky.

The strongest controls are the ones that still work even when the employee believes the message is real.

Authentication Is the Control That Holds

Authentication is one of the first places organizations should look. Many organizations have implemented multi-factor authentication (MFA), but not every form of MFA provides the same protection against phishing. Certain attacks are designed to capture credentials, authentication responses, or authenticated sessions even when MFA is in place.

Phishing-resistant authentication offers stronger protection. Technologies such as passkeys, hardware security keys, and appropriately implemented certificate-based authentication can help because authentication is not dependent simply on something an employee can type, communicate, or approve.

The important distinction is simple: the employee should not have to recognize the fake login page for the authentication control to protect them.

Train for Verification, Not Recognition

Authentication is only one piece of the defense. Security awareness still matters, but what we teach needs to change.

Employees should spend less time looking for bad grammar and more time understanding verification procedures. A request to transfer money, change payment instructions, reset credentials, disclose sensitive information, or grant access should trigger a defined verification process regardless of how legitimate the email, phone call, or video appears.

Urgency, secrecy, or pressure to bypass an established process should become the warning signs. Most importantly, employees need to know they will be supported for following verification procedures, even when the person making the request turns out to be exactly who they claimed to be.

The goal is not to turn every employee into a digital forensics expert. It is to make following the right process easier than falling for the wrong request.

Get More from the Technology You Already Have

Technology also has an important role to play. Many organizations already have security capabilities that go beyond evaluating whether an email simply “looks suspicious.” Email, identity, and endpoint security platforms can help identify suspicious activity and provide additional layers of defense.

Before buying another security product, organizations should first understand what capabilities are already available within their existing technology stack and, more importantly, whether they have been properly configured and are being monitored. A security capability that is purchased but never properly implemented provides little protection.

You May Not Need a Security Operations Center

The question then becomes who monitors those capabilities and responds when something is detected. For many mid-sized organizations, building and staffing a 24/7 security operations center is neither practical nor necessary.

A better approach is to prioritize the controls closest to the risk. Start with identity and authentication. Establish clear verification procedures around payments, banking information, credential changes, sensitive data, and privileged access. Make sure existing security capabilities are properly configured. Then determine where outside monitoring or managed security services are needed to supplement the internal team.

Fix the Gaps Before Adding More Technology

That same prioritization should apply to security investments. Buying more detection technology before strengthening authentication and high-risk business processes can mean spending security dollars in the wrong place.

The problem is often not the absence of another security product. It may be an organization with MFA that has never been evaluated against modern phishing techniques, a payment verification process that gets bypassed when someone applies pressure, or security capabilities that were licensed but never fully implemented.

Finding those gaps through an assessment is considerably better than discovering them during an incident.

For organizations that want to know how well their defenses would hold up against today’s AI-enabled attacks, our Risk Advisory professionals can assess existing controls, identify gaps, and help determine where to focus next.