Column says phishing drills still test yesterday's lures
Original title: Why do we keep testing employees for yesterday’s phishing attacks
The author urges measuring reporting speed and response, not only click rates, as AI-written lures improve.
A CSO Online column argues that awareness programs still grade employees on familiar phishing tells such as spelling errors and generic greetings, while generative AI can produce personalized, professional messages. It cites a 2025 SC Media report on Egress research: 75% of phishing kits examined on dark-web markets advertised AI capabilities and 82% offered deepfake features, figures limited to kits studied. The author, who says they ran simulations including one in October 2026, wants scenarios built around supplier requests and colleague impersonation, plus measurement of reporting speed, inbox removal and account checks. The piece is commentary, not a new incident.
Unconfirmed: The 75% and 82% figures describe kits examined in cited Egress research, not all phishing.
- Egress figures cover kits examined, not all phishing activity, the column notes.
- Equal click rates can hide very different reporting and detection outcomes.
- NCSC phishing guidance is cited as material to put on websites or HR portals.
- The author says a simulation click is not proof someone would cause a real compromise.
- Suggested drills include unexpected document sharing and supplier or colleague impersonation.
- 1.Verify unusual requests through a trusted channel even when the message looks legitimate.
- 2.Track whether staff use the approved reporting channel and how fast reports reach analysts.
From the original article
4 min read at csoonline.com
“Yesterday’s price is not today’s price,” a phrase Fat Joe popularized in 2021, reminds us that what worked yesterday may not deliver the same value today. In cybersecurity, this matters when we continue to assess employees against familiar phishing techniques while attackers use AI to craft more convincing, personalized messages.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.