Kasey Cromer, Netlok | June 16, 2026

Executive Summary

In 2026, phishing is no longer a numbers game. For years, attackers relied on volume — sending millions of generic emails and hoping enough would land. AI has changed the economics entirely. Attackers can now generate convincing, role-specific, context-aware phishing campaigns in minutes, personalize them at industrial scale, and execute credential theft before most security teams have time to respond. According to Microsoft’s 2025 Digital Defense Report, AI-generated phishing emails achieve a 54% click-through rate compared to 12% for traditionally written messages — a 4.5x increase that is a direct ratio of those two reported figures, not a separate metric. That is not a marginal improvement. It is a fundamental shift in the threat landscape.

For security leaders, the question is no longer just how to stop every malicious message from reaching a user. It is what an attacker gains if one gets through. If the answer is a reusable credential, the organization has left the most valuable thing attackers are after fully exposed. Photolok by Netlok is built to eliminate that exposure at the identity layer — removing the password from the equation entirely so the phishing threat changes fundamentally.

The Phishing Economy Has Been Rebuilt Around AI

Phishing has always been an identity problem disguised as a messaging problem. The email is the vehicle. The credential is the prize. AI has dramatically improved how the attack is delivered, but the underlying objective has not changed: gain access to an environment by stealing, reusing, or manipulating identity.
 
For years, the quality of a phishing attack depended on attacker investment. A generic mass campaign was cheap but unconvincing. A well-crafted spear phishing email — one that targets a specific person using their role, language, and business context — required significant research and skill. AI collapses that tradeoff. An attacker can now use publicly available data from LinkedIn, company websites, and prior breach exposure to build credible, personalized lures at scale. A fake invoice referencing a real vendor. A message from the apparent CFO in the correct internal tone. A support request timed to coincide with a system outage. These are no longer exclusive to sophisticated nation-state actors. They are accessible to any attacker willing to use the tools now widely available.

Microsoft’s 2025 Digital Defense Report described AI-assisted phishing as “the most significant change in phishing over the last year.” The 54% click-through rate on AI-generated messages, compared to 12% for traditional campaigns, reflects a difference in precision rather than volume. AI enables attackers to localize content, match a recipient’s role and communication style, and reduce the friction that causes users to pause and question whether a message is legitimate.

KnowBe4’s 2025 Phishing Threat Trends Report adds important context. The report found that the vast majority of polymorphic phishing attacks — campaigns designed to vary their content across messages to evade pattern-based detection — utilize AI. This means attackers are not simply writing better messages. They are using AI to ensure that filters and security teams see each message as something new, preventing signature-based detection from catching the wave before it reaches users.

Credentials Remain the Core Target

Verizon’s 2026 Data Breach Investigations Report analyzed more than 22,000 confirmed breaches across 145 countries. Across those breaches, 62% involved a human element, credential abuse appeared in 39% — not just as the way attackers first get in, but as a recurring factor at every stage of the breach — and social engineering was the primary pattern in 16% of cases. These figures overlap; a single breach can be counted in more than one category.

IBM’s 2025 Cost of a Data Breach Report found that phishing was the most common way attackers gained initial access, responsible for 16% of breaches studied, and that phishing-related breaches carried an average cost of $4.8 million. That number belongs in the boardroom. Phishing is not a threat an organization can afford to treat as routine. It is a financial risk with direct relevance to cyber insurance, business interruption, and regulatory exposure.

Microsoft’s 2025 Digital Defense Report offers a telling data point on where the money goes when identity is compromised. Looking specifically at incident response investigations where outcomes were clearly identified, business email compromise — fraud in which attackers impersonate a trusted executive, supplier, or finance contact to manipulate payments or access — appeared more often than ransomware, at 21% (business email compromise) versus 16% (ransomware). Identity is now the primary path to financial fraud, not just operational disruption. These figures come from Microsoft’s own investigation data and are separate from the Verizon DBIR findings cited above.

What connects these findings is a consistent underlying pattern. Whether the entry point is a phishing email, a voice call, or a credential purchased from a prior breach, the outcome attackers are working toward is the same: a valid identity signal that lets them move through an environment looking like a legitimate user. The way attackers get in is evolving. What they are after is not.

Speed Is Now the Defining Risk

What makes AI-powered phishing especially dangerous in 2026 is not only improved message quality. It is speed. The window between a phishing message landing and a successful credential capture has compressed to the point where traditional detection and response assumptions no longer hold.

As email-based phishing defenses have matured, attackers have adapted. Verizon’s 2026 DBIR measured mobile-centric phishing — attacks delivered via voice calls and text messages — for the first time at scale and found a 40% higher median click rate on phone-based attacks compared to email-based phishing simulations. This is not simply a channel shift. It is the next evolution in how attackers pursue the same objective. As organizations build stronger defenses around one technique, attackers move to the environments where users are least guarded, and enterprise controls have the least reach. An employee who would scrutinize a suspicious email may respond instinctively to a text message or voice call without the same level of skepticism.

What follows a successful credential capture is no longer slow. Mandiant’s M-Trends 2026, based on more than 500,000 hours of incident response investigations, found that the median time between initial access and handoff to a ransomware group has collapsed to just 22 seconds. Once phishing delivers a working identity signal, what comes next moves at machine speed. The old security model assumed that detection quality could compensate for occasional prevention failures. In an AI-accelerated phishing environment, that assumption is no longer valid. The time between a prevention failure and attacker action is now measured in seconds.

Why Traditional Defenses Are Falling Behind

Most enterprise phishing controls were designed to block malicious content at the edge, then rely on user awareness to catch what slips through. That architecture still matters, but it is under pressure from three directions simultaneously.

First, AI improves message quality enough to defeat many content-based controls. The grammar errors, generic greetings, and off-brand formatting that users were trained to spot are disappearing from AI-generated campaigns. Second, AI increases variation enough to undermine static detection signatures. Filters that block yesterday’s campaign have no reliable signal for today’s. Third, AI reduces attacker cost enough to make high-quality personalization economically viable at scale. The economic barrier that once separated mass phishing from targeted spear phishing no longer exists in any meaningful way.

Microsoft’s data reinforces the severity of the shift. Identity-based attacks rose 32% in the first half of 2025 alone, and the report notes that more than 97% of those attacks were password-based — spray attacks, brute force attempts, and credential stuffing. That figure is important because it reveals the structural weakness that AI-powered phishing is designed to exploit. Passwords exist across every enterprise environment, they are reused, they are exposed in prior breaches, and they are exactly what a convincing phishing email is designed to capture.

Security awareness training remains necessary but is no longer sufficient on its own. Training users to recognize suspicious content is less effective when the content is well-written, context-specific, and timed to match a real business event. AI-generated messages do not ask users to overcome obvious red flags. They ask them to override familiarity. That is a fundamentally harder ask, and no training program was designed to absorb click-through rates of 54%.

How Photolok by Netlok Addresses the Gap

The most effective response to AI-powered phishing is not to get better at stopping every malicious message. No organization can guarantee that outcome. The stronger question is what an attacker gains when a message gets through. Photolok by Netlok is a passwordless identity provider that replaces vulnerable, text-based credentials — passwords that can be stolen, guessed, or phished — with photo-based authentication that cannot be extracted or replayed. Photolok integrates with platforms like Okta Workforce and sits at the identity layer beneath all applications, delivering consistent protection across the entire environment.

Photo-based authentication. Users identify images from a photo panel rather than entering a password.Because authentication is based on visual recognition of login photos rather than a password, there is nothing for an attacker to steal, copy, or use to gain access. A successful phishing campaign that captures nothing of operational value does not generate a breach.

1 Time Photo. Users can configure up to five single-use photos for authentication. When a 1 Time Photo is active, only the designated single-use panel appears during login and the user’s standard login photos remain hidden. Once used, that photo is no longer available. Even if an attacker intercepts a login flow or records a session, there is nothing to steal, copy, or use to gain access. There is no pattern for AI to learn and no value in replaying what was observed.

Duress Photo. Users can configure up to two Duress Photos, randomly selected for display during login. If an employee is pressured into authenticating under coercion — a scenario that AI-generated voice clones and deepfake impersonation make increasingly plausible — selecting a Duress Photo triggers a real-time alert to security teams the moment it is chosen. The attacker sees a completed login. The security operations center receives a real-time distress signal. This is a capability that passwords, passkeys, and biometrics do not provide. The Duress Photo protects the person behind the credential, not just the credential itself.

For organizations where AI-powered phishing is generating click-through rates that no awareness program was designed to absorb, Photolok changes the calculus entirely. When there is no password to steal, the campaign has nothing to deliver.

The Bottom Line

AI has not invented a new threat. It has made an old one significantly faster, more convincing, and harder to stop by filtering messages alone. Phishing remains effective in 2026 for the same reason it has always been effective: identity is the most reliable way to look legitimate inside an enterprise environment. The Verizon 2026 DBIR confirms that credential abuse is present in 39% of all breaches. IBM’s 2025 findings put the average cost of a phishing-related breach at $4.8 million. And Microsoft’s research shows that AI is already achieving click-through rates that fundamentally change the risk equation for every organization.

The strategic response is not to concede the inbox and hope detection catches what gets through. It is to ensure that what gets through has nothing of value to deliver. Photolok replaces traditional credentials at the identity layer, simplifies the login experience for employees, and gives security teams a real-time signal when someone is authenticating under duress.

When there is no password to steal, the speed of the attack is irrelevant.

Request Your Personalized Demo

About the Author

Kasey Cromer is Director of Customer Experience at Netlok.

Sources

[1] Microsoft. ‘Microsoft Digital Defense Report 2025.’ October 2025. microsoft.com

[2] Verizon. ‘2026 Data Breach Investigations Report.’ May 2026. verizon.com/business/resources/reports/dbir

[3] IBM. ‘Cost of a Data Breach Report 2025.’ 2025. ibm.com/reports/data-breach

[4] Mandiant / Google Threat Intelligence Group. ‘M-Trends 2026.’ March 2026. mandiant.com

[5] KnowBe4. ‘Phishing Threat Trends Report, Vol. 5.’ March 2025. knowbe4.com

[6] Netlok. ‘How Photolok Works.’ netlok.com