Phishing protection: how AI phishing works and how leaders cut it

How does phishing work today, including AI-written phishing?

Phishing is a fake message that tricks a person into handing over a login or opening malware. AI now helps attackers write those messages at scale and make them harder to spot.

The 2023 Phishing Guidance from CISA, NSA, FBI and MS-ISAC says lures steal login credentials or deliver malware, often by posing as a supervisor or IT staff. Per that same 2023 CISA, NSA, FBI and MS-ISAC guidance, lures come by email, text, chat apps or phone calls with spoofed caller ID.

Phishing and spoofing was the most reported crime type to the FBI in 2025, with 191,561 complaints and $215,843,126 in adjusted losses, according to the FBI IC3 2025 Internet Crime Report (2026). The same FBI IC3 2025 Internet Crime Report (2026) says AI can create convincing synthetic content, such as personalized conversations, often in mass quantities and increasingly hard to detect.

Verizon's 2026 Data Breach Investigations Report found phishing was the way in for 16% of breaches, unchanged from the year before. In the 2026 Data Breach Investigations Report, Verizon says the share has barely moved in recent years, so AI help may not be raising success rates.

Attackers still need a person to click a link, type a password or approve a request. Two controls cut that risk at the source: email protection and phishing-resistant sign-in.

What does email protection do against phishing?

Email protection checks whether mail comes from the sender it claims and watches accounts for signs that a phish worked.

CISA's Cross-Sector Cybersecurity Performance Goals 2.0 (CPG 2.0, 2025) call for SPF, DKIM and DMARC on all corporate email, with DMARC set to reject. SPF lists the servers allowed to send mail for your domain. DKIM adds a digital signature to outgoing mail. DMARC tells receiving servers what to do with mail that fails those checks, and a reject setting has them refuse it.

Mail inside the company needs watching too. The CISA, NSA, FBI and MS-ISAC Phishing Guidance (2023) says internal mail monitoring matters because staff can be phished from outside the network. Staff reports also help email providers spot new phishing, according to that 2023 CISA, NSA, FBI and MS-ISAC Phishing Guidance. After a confirmed case, the same 2023 Phishing Guidance from CISA, NSA, FBI and MS-ISAC says accounts are re-provisioned and access is audited.

Attackers use AI to write convincing phishing emails, so FunctionOne analysts watch Microsoft 365 for unusual sign-ins and forwarding rules. Within rules the client approves, analysts can contain a problem by requiring a password reset or disabling an account. Scope and response rules are agreed with leadership during the first step, a security assessment that reviews systems and accounts. FunctionOne then reports to leadership with owners and next steps.

What is phishing-resistant sign-in?

Phishing-resistant sign-in is a login method that stops sign-in secrets from reaching a fake website, as defined in NIST SP 800-63B-4, Digital Identity Guidelines (2025). Those 2025 NIST Digital Identity Guidelines say it works without relying on user vigilance.

NIST SP 800-63B-4 (2025) says passwords and typed-in codes from text, voice or an app do not qualify, and FIDO2 and WebAuthn keys can. The same NIST SP 800-63B-4 (2025) guidelines require phishing-resistant sign-in at the top assurance level and offer it at the middle level.

CISA's Cross-Sector Cybersecurity Performance Goals 2.0 (CPG 2.0, 2025) rank sign-in methods and put administrator accounts first in line.

What does staff phishing training do?

Staff phishing training teaches people to spot a lure and report it fast. CISA's Cross-Sector Cybersecurity Performance Goals 2.0 (2025) call for training at least yearly for all users on spotting and reporting social engineering.

Those 2025 CISA goals also add role-based training for finance, leaders and administrators. People in those roles approve payments, make big decisions or control access, so a mistake there costs more. Training that fits the job prepares staff for the lures they're most likely to see.

Fast reporting helps the whole company. CISA, NSA, FBI and MS-ISAC note in their Phishing Guidance (2023) that staff reports help email providers spot new phishing. Make reporting easy, and thank the people who report.

Phishing simulations test what training taught. NIST's Phish Scale User Guide (2023) says click and reporting rates give an incomplete picture of risk. Read simulation results next to sign-in coverage and email authentication status.

What should leadership see in phishing reports?

Leadership should see whether core defenses are in place and whether open problems get fixed. A clear phishing report uses plain terms and names an owner for each open item.

1. Sign-in coverage, administrators first. CISA's 2025 performance goals rank phishing-resistant sign-in highest and start with administrator accounts.
2. Systems without multifactor sign-in. A named list shows where a password alone still guards access.
3. Email authentication status. CISA's 2025 performance goals call for SPF, DKIM and DMARC on all corporate email, with DMARC set to reject.
4. Training completion. Leaders should see who finished yearly training, including role-based training for finance, leaders and administrators.
5. Staff reports and click rates. Read both rates together, since NIST's 2023 Phish Scale User Guide calls them an incomplete picture of risk.
6. Phishing cases and follow-up. The 2023 Phishing Guidance from CISA, NSA, FBI and MS-ISAC calls for re-provisioning accounts and auditing access after a confirmed case, so the report should show both steps.
7. Open remediation items and repeat findings. Repeat findings show where a fix didn't hold.

If an item has no owner or no target date, ask who will close it and when. Gaps that show up month after month belong on the leadership agenda.

Where can we find phishing protection help in Syracuse, NY, or Tampa, FL?

FunctionOne provides managed IT and cybersecurity, including phishing email monitoring, from offices in Syracuse, New York, and Tampa, Florida. Function One Systems, Inc. was founded in Syracuse in 1992.

Its Syracuse office is at 6216 Thompson Road, Syracuse, New York 13206. In Tampa, the second office is at Industrious Downtown, 401 East Jackson Street, Tampa, FL 33602. Leaders in either city can call 315-437-6714.

FunctionOne works with established mid-size and large organizations that have outgrown a help desk. Clients choose managed IT, cybersecurity or both, fully managed or co-managed beside an in-house IT team. Work starts with a security assessment of systems and accounts.