AI is making phishing harder to spot: Why enterprises need to rethink the human factor in cybersecurity

By Manpreet Singh, Co-Founder & Principal Consultant, 5Tattva

With our growing reliance on digital transactions, cloud applications, remote entry, and connected workspaces, cyber security threats can no longer be restricted to tech failures. It can also surface from decisions that employees make every day. An odd email, a sudden MFA demand, or a strange request about private data can become a security incident if not questioned or verified.

Cybersecurity is usually connected with technology – firewalls, endpoint protection, identity controls and security monitoring. While these controls are essential, people are an equally important part of the security landscape. Every day, employees make decisions that can affect an organisation’s security, often across more devices, locations and platforms than ever before. A simple decision to stop and verify something unusual can sometimes prevent a much bigger problem.

From training to everyday behaviour

Security awareness is not just a yearly training course; it’s a mindset. The real security decisions are made by people at work – when an unexpected email lands, a strange MFA request pops up or someone asks for sensitive information. Employees don’t have to be cybersecurity experts. They need concrete habits to remember: Pause. Verify. Report.

When you get a surprise request, take a moment and double-check it before doing anything. Such habits can be supported by technology. Security awareness platforms can conduct regular phishing simulations and practical training, while email security solutions can scan messages, links and attachments before they reach employees. Automated threat detection can alert on suspicious behaviour and give security teams more visibility.

Phishing is evolving

Phishing is no longer just about poorly written emails. With Indian businesses turning more and more to digital payments, online communication and mobile-first working, attackers are replicating trusted channels and familiar business processes to make fraudulent requests look legitimate. Generative AI is also enabling these attacks to be more impactful, allowing attackers to generate highly personalised messages via email, SMS, phone calls, collaboration platforms and QR codes. Therefore, it is important to look beyond the presentation of a message and to question the request.

Ask: Was I expecting this? Does the request make sense? Should I verify it first?

Requests containing payments, credentials, changes to access or sensitive information should receive special attention. Technology also plays an important part here. Email security can flag suspicious senders and links, while URL and attachment scanning can help detect malicious content before it ever reaches an employee. Email authentication technologies can also reduce the risk of attackers posing as trusted domains for organisations.

But no technology should be considered a panacea. Even a well-executed social engineering attack can get through to an employee, so human judgment is an important additional layer of defence.

Even a well-executed social engineering attack can get through to an employee, so human judgement is an important additional layer of defence.

Reporting makes a difference

Recognising a suspicious message is valuable. Reporting it quickly is even more useful. A reported phishing attempt allows the security team to review the message, identify other recipients and take appropriate action. Reporting therefore should be easy. A simple reporting option in the mail client removes unnecessary friction.

Once reported, security teams may utilise their security monitoring and threat detection systems to investigate the sender, domain, link or attachment to see if similar activity has been seen elsewhere in the organisation.

This is where the layers of human and technology become very important. An employee can provide an important early warning, and technology enables the security team to investigate and respond at scale.

Cyber hygiene is built through small habits

Good cyber hygiene is a lot about consistency. Keep your systems up-to-date. Using strong, unique passwords and MFA properly. Watch out for unexpected links and attachments. Protect your sensitive data. Look for strange requests.

Many of these practices can be supported by technology. Identity and control of access can help ensure employees have access to only those applications and information they need. Endpoint security monitors devices for unusual activity and can help security teams react to anything strange that’s found. Data protection controls can stop sensitive information being disseminated through unauthorised channels.

Organisations can also adopt a Zero Trust approach, where access is continuously verified based on factors like the user’s identity, device and risk level, instead of being automatically trusted because the user is inside the corporate network.

Make security relevant

The risk is different for every team, every work environment. Security awareness should be aligned with how employees work day to day, whether that’s working with cloud apps, handling customer data, making digital payments or working from home. Fraudulent requests for payment could be targeting finance, credentials or API keys could be sought from developers, and malicious documents could be sent to HR. Executives could be impersonated and employees using cloud applications could have their accounts hacked or receive unusual login requests. When your employees can see examples relevant to the work they do, they will be more receptive to security awareness.

Rather than just testing if employees can identify phishing. Ask them: “What would you do if this happened to you?”

Technology can then provide the next line of defence. For example, if an employee clicks on a malicious link, email and endpoint security controls may still be able to detect and block the threat. MFA and identity controls can make it harder for an attacker to gain access to sensitive systems if credentials are compromised.

This is a big shift in how cybersecurity is thought about. Security can’t assume employees never make mistakes. It should be designed to limit the impact when they do.

Building a stronger security culture

Technology remains important but employees can provide yet another layer of security visibility. They could spot something odd, challenge a suspicious request or report a phishing campaign before it goes viral.

• Employees recognise and report.
  
• Security technology detects and protects.
  
• Security teams investigate and respond.

The goal is not to have employees that never make mistakes. The aim is to create a culture where people feel safe to stop, check and speak up, and where technology provides an extra layer of protection when things go wrong.

Security awareness, phishing prevention and cyber hygiene are most effective when they are embedded in everyday behaviour and reinforced with security controls that are designed around real-world human behaviour.

Now as Indian enterprises become increasingly digital, stronger cybersecurity will require more than another security tool. It will require security designed around how people actually work – and how they can make mistakes. Sometimes it begins with better security design. And sometimes it begins with waiting a few seconds before clicking, while ensuring that the organisation has the technology to respond when that moment of caution does not occur.