Phishing in the AI era: when the "suspicious email" arrives in flawless language

For years we taught employees to spot suspicious emails by their clumsy language and odd salutations. That era is over. According to ENISA's 2025 threat landscape report, around 80% of social engineering attacks are now AI-assisted: flawless wording, personalised content, increasingly reinforced with deepfake audio and video.

What does this mean in practice?

• 6 out of 10 breaches start with an email; phishing remains by far the most common entry point.
• The attacking email now arrives in flawless language, referencing your company's real projects and partners.
• The deepfake phone call — an urgent transfer request "in the boss's voice" — is now an active attack method in Europe too.
• AI-generated malware grew by 190% between 2023 and 2025. The barrier to entry has collapsed; today almost anyone can attack.

The weakest link is still the human, not because people are careless, but because the quality of attacks has improved dramatically. "Spotting the suspicious email" is no longer enough on its own.

What can a mid-sized company do?

1. Technical foundations

Correctly configuring the technical layer of email protection (SPF, DKIM, DMARC) stops a large share of attacks before they ever reach a person. On top of that come endpoint protection and multi-factor authentication (2FA); the latter radically reduces the impact of compromised passwords.

2. Live phishing simulation

Not theory but measurement: with a realistic phishing campaign we find out what percentage of your organisation clicks, and who would hand over their password. The results are quantified and anonymous: an excellent starting point for improvement.

3. A recurring awareness programme

Awareness is not a one-off training session but a capability you maintain. Staff training (password handling, 2FA, social engineering), executive training (decision-maker liability, incident playbooks, crisis communication) and an information security policy, refreshed regularly.

4. A rehearsed incident plan

If things do go wrong, the first 60 minutes matter: isolation, revoking credentials, preserving evidence. Decisions made in panic (immediate deletion, reinstalling) often cause more damage than the attack itself.

Where to start?

Zenit's phishing simulation and awareness programme is built exactly on these steps, from the technical review (SPF/DKIM/DMARC) through the live campaign to the training sessions. One measurement shows you where your organisation stands today.