AI-generated phishing has made human vigilance necessary but insufficient. The real defense is layered — technical controls that catch what training misses.
For years, the standard answer to phishing was "train your people." It was never the whole answer. In 2026, with AI generating emails that are nearly indistinguishable from real ones, it's not even most of the answer.
Training still matters. But it's now the last line of defense, not the first. Here's why, and what to put in front of it.
What changed
Phishing used to have tells: awkward grammar, wrong domains, suspicious links. AI removed most of those. A convincing email from your CEO, referencing a real recent project, from a look-alike domain, is now cheap to produce at scale.
That means the volume is up, the quality is up, and the margin for human error is down. Relying on every employee catching every message, every time, is a bet you'll eventually lose.
The layers that actually work
A layered defense assumes some phishing will get through and stops it from doing damage:
- MFA everywhere, especially email. Even a stolen password rarely leads to a breach when the second factor stops it. This is still the single highest-return control.
- Conditional access. Block logins from impossible locations, require compliant devices, and step up authentication for risky sign-ins.
- DMARC, DKIM, and SPF. These email-authentication records stop domain spoofing at the receiving server, before a user ever sees the message.
- Modern email filtering. Today's better filters use behavior, not just signatures — and quarantine the suspicious without burying your team in false positives.
- Reduced blast radius. Limit admin accounts, remove legacy protocols like basic auth, and isolate what a compromised mailbox can actually reach.
Where training still earns its place
Training doesn't replace these layers — it complements them. People catch the things filters won't: a slightly off tone, a request that doesn't fit the relationship, a "this feels wrong" moment. A culture where reporting a suspicious email is fast and praised is genuinely valuable.
But train for the world as it is: short, specific, and repeated. Annual click-rate modules don't build reflexes.
The honest framing
If your security plan for phishing is "our people are careful," that's not a plan — it's a hope. Careful people plus layered controls is a plan.
Want to see where your gaps actually are? Book a strategy call and we'll map them.