Phishing Tests Are Teaching Staff to Spot Yesterday's Attacks
As criminals use AI to craft messages that look entirely legitimate, security training built around spelling mistakes and generic greetings is becoming less useful. Britain's National Cyber Security Centre has guidance that points to a better way.
Key points
- The UK's National Cyber Security Centre (NCSC) publishes a multi-layered phishing defence framework that goes well beyond click-rate measurement.
- A 2025 SC Media report on Egress research found 75% of phishing kits sold on criminal markets advertised AI capabilities, and 82% offered deepfake features.
- How quickly an employee reports a suspicious email matters more to security teams than whether they clicked it.
- Traditional warning signs such as spelling errors and generic greetings are becoming less reliable as AI generates professional, personalised messages.
- Security programmes that ignore what happens after a suspicious email arrives leave a critical gap in operational readiness.
For years, organisations have run phishing simulations and measured success by the percentage of staff who didn't take the bait. That number is easy to put in a board slide. It is also increasingly misleading.
The classic red flags employees are trained to spot are appearing less often. Generative AI, the kind of software that writes fluent text on demand, lets criminals produce personalised, contextually accurate messages at scale. A 2025 SC Media report covering Egress research found that 75% of phishing kits examined on dark-web criminal markets advertised AI capabilities, and 82% offered deepfake features. Those figures cover the kits analysed, not all phishing in the wild, but they show where the commercial tools are heading. When attackers can replicate a colleague's tone and reference real business context, the habit of spotting surface-level oddities stops being enough.
Why a click rate alone doesn't protect you
A clicked link is one data point. What happens next determines whether a real attack succeeds.
Picture two teams with identical click rates on a simulated phishing email. In the first, anyone who suspects a message reports it within minutes, giving the security team time to warn others and pull the message from inboxes. In the second, suspicious emails get deleted quietly and analysts hear nothing. The headline figure looks identical. The organisation's ability to stop a live attack is not.
Reporting rate and time-to-report are the metrics that connect awareness training to actual defence. The NCSC's phishing guidance makes this case directly, recommending a multi-layered approach that treats detection and response as seriously as prevention: technical controls, user education, incident-response procedures, and reducing the impact of attacks that get through. Our 17 September story on 2.47 million simulated attacks found the same gap between what companies track and what actually limits damage.
What should organisations do differently?
Update the scenarios. A simulation built around a generic link-click no longer reflects how a well-resourced criminal operates. Realistic exercises now need to include fake supplier requests and messages that impersonate a known colleague using accurate job titles and recent context.
Beyond that, train verification, not just recognition. If a message looks completely legitimate, the right habit is to confirm through a trusted channel, calling the sender on a known number rather than relying on a tell that may not be there.
Also test the organisation's response, not just individual behaviour. Security, IT and finance teams should practise what they do when a phishing attack succeeds, because it will, eventually. Can analysts identify every inbox the message reached? Can the organisation block the attacker's infrastructure quickly and check accounts for signs of unauthorised access?
Blaming or ranking employees by pass-fail rates discourages the honest reporting that makes all of this work. Fear of embarrassment is a security liability.
Writing in CSO Online, practitioner Abi Tyas Tunggal put the practical tension plainly: click rates are the metric organisations know how to present, not necessarily the one that reflects their real exposure. That gap between comfortable measurement and genuine readiness is the problem worth solving now.
Common questions
Does this mean phishing simulations are useless?
No. They still surface weaknesses and build habits. The issue is treating a single click-rate figure as the full picture; reporting speed and post-incident response tell you far more about whether the organisation could limit damage from a real attack.
What should ordinary employees actually do when they get a suspicious email?
Don't click it, don't delete it quietly. Use whatever reporting button or address your employer provides, and if the message claims urgency or appears to come from someone you know, call that person directly on a number you already have, not one given in the email.
