AI makes phishing content indistinguishable from reality, with the human factor accounting for 62% and rising | Verizon DBIR 2026 Interpretation ②

In the previous article, we discussed vulnerability exploitation reaching its peak — attackers are compressing weaponisation windows with AI, and defenders are struggling to keep up. However, the DBIR also recorded another equally noteworthy phenomenon: AI is rewriting the quality threshold of social engineering attacks, while defenders' coping strategies are still stuck in the past era.

The 19th edition of the DBIR in 2026 analysed 22,000 confirmed breach incidents globally, with human factors appearing in 62% of the breaches, up slightly from the previous year. Social Engineering was the third largest breach pattern, accounting for 16% of all breaches. The numbers themselves have not changed much, but the quality of the content used in attacks is nothing like what it used to be.

The Old Methods of Manually Identifying Phishing Content are Failing

In the past, security training had an effective teaching logic: teaching employees to identify suspicious signals — unusual spelling of sender addresses, grammatical errors in the email body, link domains and brand names slightly off. These signals were effective because the production cost of phishing emails was high, the cost of generation was high, and attackers had to rely entirely on manual effort to produce this engaging content.

AI has changed this premise.

Generating a customised phishing email with perfect grammar, a natural tone, and incorporating the recipient's name and company background now takes only seconds. The past logic of identifying phishing content based on typos and awkward phrasing basically fails in the face of AI-generated content.

The DBIR explicitly pointed out in this year's report that the median number of techniques used by threat actors in AI-assisted attacks has reached 15, covering the entire chain from target selection, writing lure content, to generating malicious tools. Social engineering is the most natural and lowest-barrier link for AI involvement.

Beyond quality improvements, AI also addresses another traditional limitation of phishing attacks: the trade-off between scale and precision.

In the past, phishing attacks either cast a wide net with generic content but low success rates, or were precisely customised with good results but high time and effort costs. AI has combined the two, batch-generating highly personalised attack content, with costs becoming lower and lower as model capabilities improve and token costs decrease.

The vectors of attack are also expanding. DBIR's Year in Review recorded a case from July 2025: an Android Trojan named Datzbro began using AI-generated Facebook event pages to push seemingly authentic event invitations to elderly users, inducing them to click and complete device takeover. The targets of such attacks are ordinary users with relatively weak prevention awareness. Attackers use AI to generate credible content in batches and deploy it on social media on a large scale at extremely low cost and with extremely wide coverage.

Image Source: The Hacker News

On the enterprise side, this logic is also evolving. AI can scrape target employees' LinkedIn information, company news, and recent business updates to generate an email that looks like it came from a real colleague or partner, with content fitting the current business scenario and a tone and phrasing that perfectly matches the corporate culture. This kind of phishing content is difficult for traditional email gateways to block, and it is also hard for employees to identify purely by intuition.

The Scenario of the Drill Determines the Effective Boundary of Training

Faced with AI-generated phishing content, security awareness training is not valueless, but rather the standard of effectiveness needs to be redefined.

The validity period of traditional training depends on the speed of change in attackers' content. When phishing emails mislead people with typos and spoofed links year after year, an annual training update is barely enough. But when attackers use AI to generate new lure content daily and customise different scripts for different industries and positions, the drill samples from a year ago no longer represent current real threats.

The core issue here is not whether to drill, but whether the content of the drill is still aligned with real attacks.

Pyxsoft's phishing email simulation platform handles this issue with a two-layer approach.

The first layer is the continuous updating of drill content — the platform's template library is iterated based on real threat intelligence, covering phishing email content and lure types used in the latest attack campaigns, ensuring that what employees face in drills is the content currently and truly used by attackers, rather than outdated samples.

The second layer is introducing AI-generated phishing email capabilities — the platform can automatically generate highly personalised phishing drill content based on employees' roles, departments, and business scenarios, simulating highly relevant social engineering content customised by attackers with AI, allowing employees to experience this new type of phishing content in a controlled environment beforehand. Once an employee is caught, the system automatically triggers targeted training content; management can see the weak links of various departments and positions in real time.

The core logic of security awareness training is: letting employees experience it in a controlled environment before the real attack comes. Only after experiencing it will they have a memory; only with a memory will they have a reaction.

Attackers use AI to generate lures, and defenders also use AI to generate drills — training defenders in the way of attackers is currently the training logic closest to real confrontation.

References

– Verizon 2026 Data Breach Investigations Report, published on May 19, 2026

– The Hacker News, New Android Trojan “Datzbro” Tricking Elderly with AI-Generated Facebook Travel Events, published on September 30, 2025

Verizon's "2026 Data Breach Investigations Report" was officially released on May 19. Click Read Original Article at the end of the text to download the full PDF.