Zero-Trust Common Sense: The Only Way To Combat AI Phishing?

It’s hard enough to stop employees falling for phishing scams as it is.

But AI deepfake tactics are making them even harder to spot.

AI technology is making cybercriminals more effective and efficient than ever before. IBM’s Cost Of A Data Breach report for 2026 has found that the amount of AI-driven attacks has risen by 56% in the space of just 12 months, driven mainly by “AI deepfake impersonations and AI-enabled malware”.

Elsewhere at IBM, its ethical red-team hackers were able to cut the amount of time taken to build a convincing phishing email from 16 hours to just five minutes, thanks to the help of generative AI.

But perhaps even more worrying is the fact that AI can make phishing emails look so convincing, that even the most security-aware of employees are at risk of falling foul of them.

Just a few short years ago, there were still a fair few ‘tells’ that distinguished false emails from genuine ones: dodgy spelling and grammar, for example, or the tone of an email not quite sounding like the supposed sender. But deepfake capabilities have ironed many of these imperfections out.

So what can you do to reduce the risk of being tricked by a potentially costly and disruptive phishing scam?

I think the way forward is to apply the same principles of Zero-Trust security to everyday communications. A combination of vigilance and good old-fashioned common sense can help minimise the chances of a phishing attempt getting past an employee who’s let their guard down.

This means assuming that any communications that don’t come from a fully verified source is a risk until proven otherwise:

• Emailing back using known addresses, rather than hitting reply to the message received

• Flagging up anything that looks suspicious to the supposed recipient, ideally using a different method of communication

• Using IT as a go-between when requests for passwords, file access or system access are made

This might all sound cumbersome and time-consuming, but it might be the only way to defend against an extremely convincing enemy.

If you have any other suggestions, I’d love to hear them - get in touch on LinkedIn to share your views.