No—not on the evidence available. AI is helping attackers make phishing and impersonation more plausible, targeted and scalable, but threat reporting does not prove that AI-generated messages reliably defeat trained employees. Security-awareness training still has a role; it should be one part of a broader defense, not the only one.
What AI changes about phishing—and what it does not prove
Threat reporting describes attackers using AI to automate phishing and improve the plausibility and targeting of social-engineering messages. Microsoft discusses these trends in its Microsoft Digital Defense Report 2025. That makes familiar warning signs—awkward wording, obvious errors or generic greetings—less dependable as a complete checklist. It does not mean every AI-assisted message is convincing, or that AI caused a particular successful attack.
Proofpoint’s 2026 report illustrates the difference between reported perceptions and a causal test. Among 953 cybersecurity professionals surveyed across 12 countries, 65% of organizations that experienced ransomware said AI made attacks more effective: 28% said “significantly” and 37% “somewhat.” Proofpoint also reported that phishing emails or other email-based social engineering were the initial entry point in 34% of ransomware incidents where the organization identified one. These are company survey findings about ransomware—not controlled measurements of how often AI phishing fools trained recipients, and not figures for all cyber incidents. See Proofpoint’s 2026 announcement.
The available sources do not establish whether AI-generated phishing defeats trained people more often than conventional phishing in a controlled comparison. So “AI phishing is undetectable” and “training no longer works” go beyond the evidence.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problems#1 Best Overall
Can employees still spot AI phishing?
Sometimes, but no single clue reliably identifies every suspicious message. Training should help people recognize context and choose a safe next step, rather than imply that careful reading alone can catch every polished impersonation. A familiar display name, plausible writing or apparent urgency is not proof that a message is genuine.
Teach employees to verify unusual requests—especially requests to transfer money, share credentials, open an unexpected attachment or change payment details—through a separate, trusted channel. Make the reporting route easy to find and use. A person who is unsure should be able to report the message without first deciding conclusively whether it is malicious.
Does phishing-awareness training work against AI-generated scams?
Training can teach recognition, verification and reporting behaviors, but awareness and action are not the same thing. Proofpoint’s 2024 State of the Phish survey found that 71% of surveyed working adults admitted to risky actions; among those respondents, 96% said they knew the inherent risks. Proofpoint characterized the findings as 68% willingly putting organizational security at risk. These are Proofpoint’s survey findings and framing, not a controlled measure of training effectiveness across all workforces. In its announcement, Proofpoint Chief Strategy Officer Ryan Kalember put the distinction this way: “Knowing what to do and doing it are two different things.” See Proofpoint’s 2024 announcement.
That distinction is a reason to make training practical, not to abandon it. Explain what to do when a message feels wrong, give people a clear reporting path, and reinforce the behavior. Avoid treating attendance, quiz completion or a lower simulation click rate alone as proof that employees will respond safely under pressure.
How to measure training without misreading click rates
A simulation click rate depends on the message as well as the recipient. A simple, conspicuously suspicious test and a difficult-to-detect one are not equivalent measures of employee susceptibility. NIST’s Phish Scale is a method for rating a simulated email’s human detection difficulty so organizations can put click rates in context; it is not a prevalence statistic or a guarantee of program effectiveness.
NIST says the scale is available at no cost for academic use. Research use requires an agreement, and commercial applications require a commercialization license. Organizations considering its use should check the terms on NIST’s page rather than assume commercial use is unrestricted.
Also look beyond clicks. Track whether people report simulations and real suspicious messages, whether reporting is timely, and whether employees can follow the verification process. Interpret results alongside message difficulty, recipient context and the program’s goals. A single rate cannot explain why someone clicked or whether the training changed behavior.
Why programs can fall short
NIST’s 2022 report on U.S. federal cybersecurity awareness programs identifies limited resources, difficulty measuring impact and employee perceptions that training can be boring or a check-the-box exercise. The report used qualitative and quantitative methods and focuses on federal organizations; it should not be treated as a survey of all workers or sectors. Its findings do, however, identify practical issues a program owner can examine. Read NISTIR 8420A.
- Limited resources: Set a sustainable schedule and prioritize useful behaviors over frequent, repetitive exercises.
- Hard-to-measure impact: Define meaningful outcomes—such as appropriate reporting and verification—and interpret simulation results in context.
- Check-the-box perceptions: Use relevant examples and explain what action employees should take, rather than making training a completion exercise.
What a stronger defense looks like
Training is most useful when it is paired with safeguards that can block suspicious activity or limit damage when someone makes a mistake. Choose controls that fit the organization’s systems and risks; no single tool or course guarantees protection.
- Make reporting and verification workable. Provide a visible way to report suspicious messages and a separate channel for confirming sensitive requests.
- Protect communications and identities. Use appropriate email-security and identity protections to reduce exposure to malicious messages and account misuse.
- Limit the impact of a mistake. Use organizational access and response controls so that one interaction does not automatically become a wider compromise.
- Review outcomes, not just completions. Examine reporting, verification behavior and simulation context, then adjust the program to address observed gaps.
The central decision is not whether training can stop every AI-enabled attack. It cannot be relied on to do so. The useful question is whether employees know how to pause, verify and report—and whether the organization’s technical and operational defenses help when they do not.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
