Generative AI has quietly flipped the economics of phishing. Microsoft's Digital Defense Report 2025, cited by the Cloud Security Alliance, measured a 54% click-through rate for AI-generated phishing messages versus 12% for manually written equivalents — and found that AI spear-phishing crossed a threshold in early 2025, outperforming expert human red-teamers for the first time. Combine that with voice-clone CEO fraud and deepfake verification bypass, and UK finance, payroll and supplier-change workflows are now the weakest link. This piece sets out what UK IT leaders should actually do about it, control by control, without inflating the threat or the budget.
View the data behind this chart
| AI-generated phishing | Manually written phishing | |
|---|---|---|
| Click-through rate | %54 | %12 |
The 2026 threat landscape: why AI phishing changed the maths
The industry has moved past debating whether AI improves phishing and on to measuring by how much. The Cloud Security Alliance's January 2026 research note, drawing on Microsoft's Digital Defense Report 2025, found AI-generated lures achieved a 54% click-through rate against a 12% rate for manually written messages in the same test set — and separately found AI-crafted messages produced a 23% higher failure rate than elite human red-team attempts. That is not a marginal edge; it is a different threat category.
Volume tells a parallel but distinct story. APWG-recorded phishing attacks hit 853,244 in Q4 2025 alone, part of roughly 3.8 million recorded across the whole of 2025, according to a June 2026 industry summary. Separately, KnowBe4 research reported by Cyber Daily found 82.6% of phishing emails now contain AI-generated elements — a measure of content composition, not volume, and one that rose sharply in the second half of 2025. Together these numbers describe an attack surface that is both bigger and better-crafted at the same time.
One caution worth stating plainly: click-through and failure-rate figures from Hoxhunt's and Microsoft's simulation datasets (over 70,000 simulations, per the CSA note) measure controlled test behaviour, not real-world enterprise compromise. They are a strong proxy for how AI content performs against human attention — but breach reports, not simulations, should anchor your risk register.
Key attack vectors: hyper-personalised phishing, hidden HTML and voice clones
Hoxhunt's phishing-trends research for 2026 found that the most common tell in AI-assisted phishing was not bad grammar but generic templates impersonating a wide range of entities, with hidden HTML markers — strings like "Main Content" and "Click to Call" — visible in the underlying code but invisible to the recipient. These are artefacts of AI content generation and templating tools, and they are a more reliable technical signal than anything a human reader will spot by eye.
Voice-clone and deepfake-enabled fraud extends the same problem into audio and video. DeepStrike's guidance for defenders explicitly recommends simulating voice and video deepfakes in security awareness training, not just email phishing, on the basis that AI-grade social engineering is now multi-channel by default. In practice this means an attacker no longer needs a single well-written email to succeed — a cloned voice on a follow-up call, or a synthetic video verification, can close the loop that an alert employee might otherwise have stopped.
- •Hyper-personalised email phishing using AI-generated content that reads as fluent and context-aware
- •Hidden HTML markers embedded by AI phishing-kit tooling, detectable in code but not in the rendered message
- •Voice-clone calls impersonating executives to authorise urgent payment or supplier changes
- •Deepfake video used to bypass identity verification steps that assume a real-time human face is proof of identity
The UK deepfake and synthetic identity challenge
For UK organisations, the sharpest exposure sits in finance, payroll and supplier-management workflows that still rely on a phone call, an email chain or a video check as the final control before money moves. Deepfake-driven CEO fraud and AI phishing are built precisely to exploit that assumption. Weak email-only controls, or MFA delivered by SMS, are not enough on their own when the attacker's opening move already beats human-written phishing on click-through.
The fix aligns closely with UK public-sector and critical-infrastructure expectations around stronger identity assurance: enforce out-of-band callbacks for any financial or supplier-detail change, and move privileged and finance-team authentication onto phishing-resistant methods rather than one-time codes sent by text. This also has a practical hybrid-Microsoft-365 payoff — strong identity and access management built around passkeys or hardware keys tends to reduce helpdesk password-reset volume as well as credential-theft risk, which is a genuine operational win rather than just a compliance box-tick.
Training needs to follow the same logic. Grammatical slip-ups are no longer a usable warning sign, so finance staff, procurement teams and executive assistants — the people most likely to receive a payment-change request — need to be treated as a specific, high-priority training and control population, not folded into generic company-wide phishing awareness.
Defence that holds: the control stack for SMEs and enterprises alike
The realistic 2026 defence stack does not require a large budget rebuild; it requires sequencing a small number of high-value controls correctly. DeepStrike's first-30-days guidance is a useful starting checklist: phishing-resistant MFA for admins and finance staff, plus mandatory callback verification for any payment or bank-detail change, implemented together rather than as separate initiatives.
The Cloud Security Alliance's research note reinforces where to spend first: FIDO2/passkeys or hardware security keys should be prioritised for externally exposed application access and privileged internal systems, because these are the accounts where AI-generated phishing does the most damage if it succeeds. For SMEs, this is often a licensing and process change rather than a large capital outlay — most organisations already running Microsoft 365 or Google Workspace have conditional access and passkey support available; the missing piece is usually the callback-verification policy and the discipline to enforce it, not new hardware spend.
This is also where a Zero Trust framework earns its keep in an AI-attack context: it assumes no single signal — a familiar voice, a plausible email, a video call — is sufficient proof of identity on its own, which is exactly the assumption AI-powered attacks are built to exploit.
- •Phishing-resistant MFA (FIDO2/passkeys or hardware keys) for admins, finance and privileged accounts first
- •Mandatory callback verification, via a pre-agreed known number, for any payment or bank-detail change
- •Multi-channel awareness training that simulates voice and video deepfakes, not only email
- •Conditional access policies that treat externally exposed apps as higher-risk than internal-only systems
Worked example: an AI-driven CEO fraud attempt, step by step
Consider a realistic composite scenario built from the patterns above. A finance director receives a fluent, well-targeted email — the kind that performs at roughly the 54% click-through rate measured for AI-generated phishing — referencing a real supplier and a plausible invoice discrepancy. It contains a link, and buried in the page's HTML are the same kind of AI-tooling artefacts Hoxhunt flagged: templated markers invisible to the reader. The finance director doesn't click, but a junior colleague on the same distribution list does.
Twenty minutes later, a follow-up call comes in — a voice closely resembling the CEO, referencing the same invoice, requesting an urgent change to a supplier's bank details before end of day. This is precisely the multi-channel pattern DeepStrike warns defenders to train against. Under pressure and time constraint, this is the exact moment traditional judgement fails: the voice sounds right, the story is consistent, and urgency discourages questions.
Layered defence is what stops it. Because privileged and finance-system access is protected by phishing-resistant MFA rather than a code that could be phished from the earlier email, the initial click does not hand over a usable credential. Because the organisation enforces mandatory callback verification for bank-detail changes, the payment request cannot proceed without a call back to the CEO's known, pre-registered number — at which point the fraud collapses immediately, regardless of how convincing the cloned voice was. No single control caught this; the combination did.
View the data behind this chart
| Layer | Detail |
|---|---|
| Identity layer | Phishing-resistant MFA for admins and finance… |
| Verification layer | Mandatory callback checks for payment and… |
| Training layer | Multi-channel simulations covering voice and video… |
| Monitoring layer | Anomaly detection for unusual access after a… |
The human factor: training, oversight and governance
Technology controls buy time, but people still make the final call on a live phone request — which is why Stingrai's IBM-sourced 2025 data showing that 60% of breaches involve the human element remains the central fact defenders have to design around, even as AI supercharges the attack surface. The goal of training is not to make staff cleverer than AI-generated content; it is to move the decision point away from "does this look convincing" and onto "does this follow the verified process."
Understanding phishing attacks as a discipline now has to extend beyond email inboxes. DeepStrike's recommendation to simulate voice and video deepfakes in awareness training, not just written phishing, reflects that finance, procurement and executive-support staff are the population most likely to face a multi-channel attempt, and they need rehearsal in that specific scenario rather than generic annual training.
UK buyers should also treat this as a governance question, not just a training one: identity-assurance expectations already established for public-sector and critical-infrastructure organisations are a reasonable bar for any business handling supplier payments or payroll, and building callback verification and phishing-resistant MFA into policy — with named ownership — closes the gap between having a control and actually enforcing it under pressure.
Measuring readiness: what to actually track
Given how fast the threat model moves, readiness metrics matter more than a one-off audit. Run your own phishing simulations regularly and benchmark your organisation's click-through rate against the reference points now public in industry research — the 54% AI-generated versus 12% manually written split gives you a sense of how much headroom AI-crafted content has over older, more visibly flawed lures. If your internal numbers sit closer to the higher end, your content and process controls, not just your technical filters, need attention.
Beyond simulation results, track coverage of phishing-resistant MFA across admin and finance accounts specifically, the percentage of payment or bank-detail change requests that actually go through callback verification (not just have a policy requiring it), and reduction in helpdesk credential-reset volume following a passkey rollout — a practical UK operational signal that identity controls are bedding in rather than just existing on paper. Pairing these process metrics with managed detection and response services gives you the anomaly-monitoring layer to catch what verification alone misses, such as unusual access patterns following a near-miss phishing click.
Beyond 2026: what's next
The Cloud Security Alliance's finding that AI spear-phishing crossed the inflection point of outperforming human experts in early 2025 is the single most important trend line here: it did not plateau, and DeepStrike's push to train staff against voice and video deepfakes — not email alone — signals that attackers are already using every channel available to them, not just the cheapest one.
The practical implication for UK IT leaders is to build controls that are channel-agnostic rather than channel-specific. Identity-based verification, out-of-band callbacks and phishing-resistant MFA hold up regardless of whether the next wave of attacks arrives by email, voice, video or an autonomous AI agent chaining several of those together. For a closer look at how attackers are automating the steps after initial access, see the latest on AI agent attacks — it is the logical next stage of the same trajectory this article describes.
Sources
Every figure in this article traces to the sources below.
- •Hoxhunt — 2026 phishing-trends research on AI-assisted templates and hidden HTML markers
- •Cloud Security Alliance — research note on AI-weaponized phishing, click-through data and passkey guidance
- •Bright Defense — June 2026 summary of APWG phishing volume data
- •Cyber Daily — KnowBe4 research on AI-generated phishing email share
- •Stingrai — IBM 2025 breach cost and human-element data
- •DeepStrike — first-30-days defence guidance on MFA, callback verification and deepfake training