06/24/2026
Most people feel relatively confident about spotting a phishing email đŁ
And a few years ago, that confidence was often justified.
You could usually rely on obvious clues. Poor spelling, strange wording, emails that didnât sound quite right.
But thatâs changed đą
Itâs becoming apparent that thereâs a clear gap between how confident people feel and what happens when theyâre tested with realistic phishing messages.
The interesting part is why people are getting it wrong: Phishing emails donât look like phishing emails anymore.
With AI helping to write and refine messages, they read like normal business communication.
The tone feels right, the language flows properly, the usual red flags arenât as obvious as they once were.
And it makes the decision much harder.
Instead of spotting something that looks wrong, youâre being asked to question something that looks completely normal.
And thatâs where things slip through.
How do you prepare your business for this?
Traditional security training often focuses on what to look for, but real-world situations donât always follow a checklist.
When someone is busy, dealing with a full inbox, and trying to keep things moving, even a well-trained person can make a quick decision that they wouldnât make with more time.
What seems to work better is building habits as well as awareness.
đ Taking a moment before acting
đ Checking where a link really goes
đ Going directly to an account instead of following an email prompt
These are small actions, but they hold up even when the message looks convincing.
đ When an email looks completely legitimate, what would make you pause before you act?
