Generative AI Changes Phishing Emails

Generative AI has fundamentally changed the way malicious emails are crafted. According to a report by Proofpoint presented at the Protect 2026 conference, phishing messages are now fluid, personalized, and unique to each recipient. This development leads to the behavioral signals that email filters have relied on for years becoming increasingly blurred. Previously, phishing emails were often characterized by clumsy wording, generic pretexts, and reused templates. These features made it easier to identify such messages.

With the advent of generative AI, however, these typical signs are less pronounced, complicating detection by automated systems. Proofpoint presented several examples of these changes during the conference. The new emails are not only linguistically refined but also better tailored to individual recipients. This is achieved through the use of AI algorithms capable of analyzing personal data and creating customized content. The implications of this development are significant.

Companies and organizations must rethink their security strategies to address the new challenges. Traditional methods for detecting phishing attacks may no longer be sufficient to identify the new, AI-generated threats. Proofpoint emphasizes that the adaptability of attackers is increasing due to the use of AI. This technology enables cybercriminals to quickly change their tactics and adapt to the responses of security measures. This poses a serious threat to cybersecurity, as attackers are now able to optimize their attacks strategically.

Another aspect raised by Proofpoint is the need for companies to better train their employees. Awareness training must be updated to account for the new forms of phishing. The training should aim to sensitize employees to the subtle signs of malicious emails created by generative AI. The challenge lies not only in detection but also in responding to such attacks. Companies must ensure they have effective incident response plans in place to respond quickly to phishing incidents.

Proofpoint recommends that organizations regularly review and adjust their security protocols to address the ever-changing threats. Research from Proofpoint indicates that the threat of AI-generated phishing emails is expected to increase in the coming years. The security industry must adapt to keep pace with these developments. A key point is the continuous improvement of technologies for detecting and defending against such attacks. Proofpoint estimates that by the end of 2026, about 70% of all phishing attacks could be attributed to generative AI. This figure underscores the urgency with which companies need to rethink their security measures.