Your defences were designed for an attacker that no longer exists

When an organisation designs its security programme — training, filters, protocols — it does so against a mental model of the attacker: someone with limited resources who must choose between volume and precision. Send thousands of generic emails and some will land, but most will be caught. Research a specific target in depth and the attack will be more convincing, but you can only do it for a handful of people at a time.

That mental model is no longer accurate. AI removed the tradeoff between scale and precision. And the defences you built assuming that tradeoff need revisiting.

The phishing that doesn't look like phishing

Traditional security awareness training teaches people to spot warning signs: typos, sender domains that don't quite match, artificial urgency, unexpected attachments. Those signs corresponded to high-volume attacks designed for the lowest common denominator — convincing someone, anyone.

That phishing still exists. But it is no longer the only kind.

A language model can, in seconds per target, draft an email that references your actual job title, the project you are working on, the name of your manager, and the context of a recent conversation. It does this with the right tone, no errors, and details that only an insider would know. It can be sent from an address that is easily confused with a real supplier or colleague.

The problem is not that the message looks legitimate. It is that it was written so that you, specifically, would find it legitimate. Training that teaches people to spot generic signals has no answer for that.

The gap nobody measures

Organisations update their security posture in long cycles: annual training, quarterly policy reviews, tool renewals every few years. That is the pace the organisation can sustain.

Attackers operate at a completely different pace. They can test variants of a lure in hours, change infrastructure in minutes, and tailor the message to each target's specific profile before sending. There is no approval meeting. There is no change process.

The result is a cadence gap that widens silently. Organisations train their employees to spot the phishing of two years ago. Attackers have spent months using techniques for which that training has no response.

This gap does not appear on any dashboard. There is no indicator that measures how long you have been defending against attacks that are no longer being used. But it exists, and it grows.

What changes for organisations

The direct consequence is that the prevention model based on user detection is broken for sophisticated attacks — not because employees are careless, but because they were trained to spot signals that are no longer there.

This does not mean training is useless. It means it cannot be the first line of defence for high-risk actions.

Organisations adapting their model are doing three things:

Verification protocols for critical actions. Wire transfers, credential changes, access to sensitive systems: regardless of who requests the action, there is a verification step outside the digital channel. The digital channel is the one that may be compromised.

Behaviour-based detection, not signature-based. A well-written email does not trigger content filters. But an unusual sequence of actions — accessing a system that is rarely used, exporting data outside business hours, running an unfamiliar process — can be detected. The focus shifts from the message to the behaviour that follows the click.

Resilience when prevention fails. Assuming that some attacks will succeed changes how the system is designed. Network segmentation, least privilege, rapid response capability: these are not last-resort measures, they are part of the design from the start.

Perspective

The gap is not technological. It is a matter of model.

Current defences were built for an attacker who had to choose: reach many or reach well. That attacker still exists, but is no longer the only one. The attacker who does not have to choose is the one most likely to get through.

The answer is not to spend more on the same things. It is to revisit the assumption on which they were built.