What Every Employee Needs to Know — Especially Now That AI Writes the Bait

By Dayton Allied Business Solutions  ·  Published February 2026

Here is something that should make every business owner uncomfortable: one-third of your employees would click a phishing link right now if the email looked convincing enough. That is not a guess. According to KnowBe4’s 2025 Phishing by Industry Benchmark Report, which analyzed over 67 million simulated phishing tests across 62,400 organizations, the baseline click rate — the percentage of employees susceptible to a phishing attempt before training — is 33.1%.

The problem is getting harder, not easier. Phishing emails used to be easy to spot: awkward grammar, odd phrasing, generic subject lines. Those days are over. In 2025, over 82% of phishing emails contain AI-generated content, and AI-crafted messages achieve a click rate of 54% — more than four times higher than traditional phishing. A third of your staff clicking a well-made fake is bad enough. With AI writing the lure, that number can more than double.

This article gives you and your team a practical, fast, and teachable process for evaluating any suspicious email — built for the threat environment that exists today, not five years ago.

Why Phishing Is Harder to Spot Than It Used to Be

The old advice — “look for typos and bad grammar” — was never the whole story, but it was a useful shortcut. AI has eliminated that shortcut entirely.

Attackers now use large language models to craft emails that are grammatically flawless, appropriately formal or casual depending on context, and hyper-personalized. An AI tool can scrape a target’s LinkedIn profile, company website, and recent press releases in seconds, then generate an email that references the company’s actual clients, current projects, or recent news. A 2024 campaign targeting small accounting firms used AI to generate customized emails referencing each firm’s specific state registration details and recent public filings — and achieved a 27% click rate.

82.6% of phishing emails now use AI-generated content — up dramatically from prior years (KnowBe4, 2025)

The Verizon 2025 Data Breach Investigations Report confirmed that AI-generated scam emails have doubled since the prior report, and the human element — someone clicking, trusting, or responding — remains a factor in 60% of all confirmed breaches. Spam filters and secure email gateways are struggling to keep up: KnowBe4 found a 47% rise in attacks successfully bypassing Microsoft’s native defenses.

The threat has also expanded beyond email. Phishing now arrives as text messages (smishing), voicemails (vishing), calendar invites, shared document notifications, and even AI-generated voice calls that sound exactly like a manager or vendor. The mechanism changes. The psychology — urgency, authority, familiarity — does not.

Source: KnowBe4 2025 Phishing by Industry Benchmark Report

The 30-Second Check: Four Steps Anyone Can Learn

You do not need to turn your staff into cybersecurity professionals. You need them to run one consistent mental check before clicking or responding to anything that looks unusual. Here is a four-step process that takes under 30 seconds and catches the vast majority of phishing attempts.

Step 1 — Ignore the Sender Name. Check the Address.

The display name on an email can be set to anything. An attacker can make an email appear to come from “Microsoft Support” or “Your CEO’s Name” without any access to those accounts at all. The display name proves nothing.

What matters is the actual sending domain — the part after the @ symbol. Train your team to look at it every time, not just when something feels off. Red flags include:

• A domain that does not match the company it claims to be from (e.g., [email protected])
• A legitimate-looking domain used to send from a different service (e.g., your vendor’s name in the display, but the actual address is a generic Gmail account)
• Slight misspellings designed to pass a quick glance (paypa1.com, arnazon.com, micros0ft.com)
• A completely unrelated domain that has nothing to do with the message content

This check alone stops a significant percentage of phishing attempts because attackers rarely control the actual domain they are impersonating.

Step 2 — Hover Over Every Link Before You Click It

Links in phishing emails almost never go where they claim to go. Before clicking anything, hover your mouse over the link and look at the actual URL that appears in the bottom corner of your browser or email client. On mobile, press and hold the link to preview the destination.

What to look for:

• The domain in the URL does not match the company mentioned in the email
• The link uses a URL shortener (bit.ly, t.co, tinyurl) which hides the real destination
• The URL contains a long string of random characters or numbers
• The domain is close but not exact (e.g., login.microsoft-security-center.com instead of microsoft.com)

One important update for 2025: attackers increasingly use legitimate services — real Google Docs links, real SharePoint links, real DocuSign pages — that then redirect to a malicious site. A URL that looks real is not automatically safe. If the message was unexpected, proceed to Step 3 before clicking even a link that looks legitimate.

Step 3 — Ask One Question: Was I Expecting This?

This is the most underrated step in the process, and often the most powerful. The vast majority of successful phishing attacks arrive as something unexpected: an invoice you weren’t waiting for, a password reset you didn’t request, a shared document from a contact you haven’t heard from recently, an urgent wire transfer request that bypassed normal channels.

The question is not: “Does this look real?” AI now makes almost everything look real. The question is: “Was I expecting this?”

If the answer is no — or even “maybe not” — that is your signal to verify before acting. Pick up the phone and call the sender using a number you look up independently, not one provided in the email. Send a new email to an address you already have on file, not a reply to the suspicious message. The extra 60 seconds of verification has stopped wire fraud, ransomware infections, and credential theft at businesses of every size.

Step 4 — Slow Down. Urgency Is the Weapon.

Every piece of phishing psychology runs on urgency. “Your account will be suspended.” “Approve this payment immediately.” “Click within 24 hours or lose access.” The goal is to compress your decision-making time to the point where you act before you think.

The countermeasure is deceptively simple: pause. A deliberate 10-to-15 second stop before acting on any urgent request is enough to break the psychological pressure. Ask yourself whether a legitimate company, bank, or colleague would actually demand that you act this fast — without calling, without confirmation, without any other verification.

Legitimate organizations do not threaten immediate account closure via email without multiple prior notices. Legitimate executives do not send first-contact wire transfer requests by email with no follow-up call. Urgency in an email is not evidence of urgency in reality. It is evidence of an attack.

What to Tell Staff to Do Instead of Clicking

Clear instruction is more effective than general warnings. When something looks suspicious, give your team a specific path to follow:

• Report it — forward it to whoever handles IT or security at your organization before doing anything else
• Do not reply to the suspicious email — replies go back to the attacker
• Do not click any links, including “unsubscribe” links in unexpected emails
• If it involves money, passwords, or account access — verify by phone using a number you already have
• When in doubt, delete it and confirm through a separate channel that the request was real

Perhaps most importantly: make it safe to ask. No employee should feel embarrassed for flagging a suspicious email or pausing on a request that seems off. The most damaging phishing attacks succeed because someone was too hurried, too uncertain, or too worried about looking foolish to stop and verify. Create a culture where slowing down is praised, not penalized.

Why Your Email Filter Is Not Enough Anymore

Spam filters and secure email gateways are valuable tools and should absolutely be in use. But the data is clear: they are not sufficient on their own. Attackers have adapted to them.

Modern phishing campaigns bypass filters by:

• Compromising legitimate email accounts — the attack comes from a real address with an established sending history
• Using real cloud services — legitimate SharePoint, Google Drive, or Dropbox links that lead to malicious pages
• Inserting themselves into existing email threads, making replies look like normal conversation
• Using QR codes in email bodies instead of clickable links, which many filters cannot evaluate
• Generating unique, polymorphic email content that changes slightly with each send to avoid signature-based detection

KnowBe4’s 2025 data found a 47% rise in phishing emails successfully evading Microsoft’s native defenses. That figure is from one of the most widely deployed email platforms in the world, with security teams actively working against these threats. The filter is a first line of defense, not a complete one. The human awareness check is what catches what the filter misses.

Source: Verizon 2025 Data Breach Investigations Report

The Good News: Training Actually Works

Here is the encouraging counterpoint to all of the above: security awareness training produces measurable results, and they come faster than most business owners expect.

86% reduction in phishing susceptibility after one year of regular security awareness training (KnowBe4, 2025)

KnowBe4’s benchmark data shows that organizations implementing ongoing security awareness training reduced their phishing susceptibility rate from the baseline of 33.1% down to just 4.1% within 12 months — an 86% reduction. Meaningfully, the initial drop is rapid: over 40% improvement within the first 90 days. You do not need a year to see results.

The Verizon DBIR corroborated this, reporting that organizations investing in regular security training saw a 4x improvement in employee phishing reporting rates. A staff member who reports a suspicious email instead of clicking it is not just protecting themselves — they may be stopping an attack that could have spread to every machine on your network.

The training that works best in 2025 is not the annual “sit through a video” format. It is continuous, adaptive, and includes realistic simulated phishing tests that use the same AI-enhanced tactics attackers are actually deploying. Generic training that teaches people to look for typos is not preparing them for the threat they face today.

Source: KnowBe4 2025 Phishing by Industry Benchmark Report

The Business Stakes: What One Click Actually Costs

It is worth being specific about what is at risk, because “a phishing click is bad” is too abstract to motivate action.

According to IBM’s 2024 Cost of a Data Breach Report, the average cost of a phishing-related data breach is $4.88 million. For small and mid-sized businesses, the figure is lower in absolute terms but often proportionally more devastating — many do not recover. The FBI’s 2024 Internet Crime Report documented over $2.7 billion in losses from Business Email Compromise (BEC) alone, which is a category of phishing that targets employees with the authority to transfer funds or change payment details.

Ransomware — the most common follow-on attack after a successful phishing click — is now present in 88% of cyberattacks targeting small businesses, according to the Verizon 2025 DBIR. The median ransom payment in 2025 was $115,000. For most small businesses, that is existential, and the ransom is only part of the cost. Downtime, recovery, reputational damage, and potential regulatory penalties add significantly to the total.

One employee clicking one phishing link can be the entry point for a ransomware attack that shuts down operations, exposes customer data, and costs hundreds of thousands of dollars. That is not hyperbole. That is the documented 2025 reality.

Source: Verizon 2025 DBIR SMB Snapshot

Quick Reference: The 30-Second Check

• Step 1: Ignore the display name — check the actual sending domain
• Step 2: Hover over every link before clicking — verify the real destination
• Step 3: Ask “Was I expecting this?” — if not, verify through a separate channel before acting
• Step 4: Slow down — urgency is the weapon, pause is the defense

• Never reply directly to a suspicious email
• Never call a number printed in the suspicious email — look it up independently
• If money or passwords are involved, always verify by phone
• Report suspicious emails before deleting them
• No employee should feel bad for pausing to verify

Phishing works because it is fast, it is designed to feel familiar, and it exploits the fact that people are busy. The 30-second check does not make your staff immune — nothing does. But it builds a habit of deliberate evaluation that dramatically reduces the odds of a click that costs you everything.

With AI now writing the bait, the old advice to “look for red flags” is not enough on its own. What your team needs is a simple, consistent, teachable process — and the culture that makes using it feel normal rather than paranoid.

If someone on your team received a perfectly written, AI-generated email from what appeared to be your bank or your largest client today — requesting an urgent wire transfer or password reset — would they know to pause and verify? If you’re not certain, that’s the gap to close.

The DaytonABS Care Plan includes phishing awareness training, simulated phishing tests, Microsoft 365 and Google Workspace security hardening, and practical staff guidance — the full layer of protection that sits between your team and the next attack. Reach out any time.

Dayton Allied Business Solutions  ·  daytonabs.com