Phishing is as old as the internet, but generative AI has turned it from a clumsy nuisance into a precision threat. According to the FBI, phishing now accounts for 26 percent of all cybercrime complaints, and losses have jumped 274 percent in the past two years. The reason is clear: large language models let attackers craft polished, context-aware emails that mimic trusted colleagues or vendors, complete with realistic branding and no spelling mistakes. What once required manual effort for spear phishing can now be automated at scale, putting sophisticated attacks within reach of anyone with basic research skills.
Defenders are responding with their own AI tools, but the approach has changed. Instead of flagging typos or suspicious attachments, modern email security models the attacker's intent by analyzing behavioral patterns and the layered structure of a campaign. This matters because a technically clean email—one with no malware or malicious links—can still be a social engineering trap. For example, an attacker might use GenAI to scan LinkedIn for new hires and then impersonate their boss in a plain-text message, grooming the victim over several exchanges before asking for a wire transfer or payroll details.
The asymmetry between attackers and defenders remains stark. As one security executive notes, attackers can use LLMs essentially for free to generate perfect phishing templates, while defenders must invest in sophisticated detection and user education. The result is that email security is no longer a passive filter but an active layer of risk mitigation, one that must support employees at the moment they make a decision. The battle is now between two forms of AI, and the outcome will shape how organizations protect their cloud and SaaS ecosystems from infiltration. [1]