Not so long ago most of us could spot a phishing email from a mile away, whether it was the clumsy spelling that gave it away, the slightly off grammar or a greeting that never quite got your name right. So, for years organisations have trained their people to watch out for those tells and to report them. However, in recent year that reassuring predictability has quietly disappeared, because attackers have found a far faster and far more convincing way to start a cyber breach, eradicating the familiar giveaways.
Generative AI now let's cyber attackers produce clean, believable and genuinely personalised messages in seconds, then send them out at a scale no human team could ever hope to match. The very same tools sit behind deepfake video and cloned voices, so a convincing approach might arrive as a phone call, a video meeting or a chat message just as easily as it turns up in an email inbox. Research has found that an increase in reports of suspected AI-enabled fraud incidents has increased by over 400% between 2023 and 2025, which means that the biggest giveaways for phishing that people leaned on most, is fading fast.
It is astounding how easily this can happen and how easily it catches even the most knowledgeable people out in the real world. Picture this: A finance manager opens a neatly written email from a supplier they deal with every week, complete with the correct logo and the right tone, asking them to update the payment details held on file. It looks completely genuine, so they make the change and the next invoice you pay then lands in a criminal's account instead of with your supplier. None of this makes your team question it because we have spent years teaching people to spot bad grammar and incorrect spelling, which is precisely what makes this new wave of attacks so effective. The real question this Cyber Awareness Month, is not whether your organisation will be targeted, but how hard a target your people are when one of these messages' land in their inboxes.
Phishing is still the threat that gets through
The government's most recent Cyber Security Breaches Survey found that 43% of businesses suffered a breach or attack in the previous year. Phishing was also the standout attack method with it landing as the most common and the most disruptive type of attack by a comfortable distance, responsible for 69% of the cases that caused disruption. The same survey also emphasised that phishing has become a lot easier for attackers to pull off than it used to be.
There is a person behind every one of those incidents, which is why the Verizon Data Breach Investigations Report attributes a human element to 68% of breaches. It would be easy to read a figure like that and conclude that employees are the vulnerability, but your people are exactly where these attacks land, which makes them your best chance of stopping them. With the right habits and training, your people can become your strongest line of defence, rather than your biggest vulnerability.
Fear is not a strategy
When a threat is moving this quickly, the natural instinct is to turn up the volume with bigger warnings, scarier training and a long list of rules, even though that approach almost never delivers what you hope for. People tend to switch off when these methods are implemented and a culture built on blame makes employees far less likely to put their hand up when something feels off or goes wrong, which is the exact opposite of what you actually need when an attempted cyber attack happens. The organisations that manage to stay ahead of threats treat awareness as a habit rather than a one-off event, which in practice comes down to three things: Knowing where you stand today, giving people safe and regular training and following a clear plan to close the gaps and risks you find within your organisation. That thinking runs right through the Boxphish campaign for Cyber Awareness Month in 2026, which sets out to help your people get phishing fit without relying on a single drop of fear.
Step one: Spot your risks
Most organisations already suspect that their awareness could be sharper, yet very few could say with any confidence exactly where the weak spots or risks actually sit. You cannot fix what you cannot see, which is exactly where the phishing fit assessment comes in, taking around two minutes to score your organisation across the areas that make the biggest difference. At the end you receive a free, tailored action plan built around your organisation, setting out the practical steps that will make your people genuinely more resilient to attacks like AI phishing.
Rather than a generic checklist, it focuses on the areas that make the biggest difference, from how often you train and run simulations, to how easily people can report something suspicious, whether multi-factor authentication is switched on and whether your teams have actually been shown what AI-based attacks look like in 2026. The assessment scores you across all of these and hands you a belt banding somewhere between featherweight and heavyweight, so you know exactly where you stand today. The action plan then turns that picture into a clear order of priorities, so a vague sense of worry becomes a specific and manageable route to building real resilience.
Step two: Turn awareness into instinct
Knowing in theory what a scam looks like is very different from reliably catching one in the middle of a hectic afternoon, a skill that only ever comes with regular practice. Our spot the phish challenge gives your people that practice in a safe and low-pressure way, setting fresh real world examples each week drawn from the biggest scams in 2026, including the AI-written emails and cloned-voice approaches that no longer give themselves away through bad spelling or a terrible accent. Because it runs across the whole month it keeps awareness right at the front of people's minds while quietly turning training from something they are told into something they do, until stopping to check an unexpected request becomes second nature rather than an afterthought.
Step three: Follow a plan, not a panic
An assessment shows you where you are today and a weekly challenge builds the habit, but shifting the dial across an entire organisation takes a plan that ties the two together, which is exactly what our full toolkit is designed to provide. It takes the areas your assessment has flagged and turns them into a practical, step-by-step action plan across the five things that matter most: Awareness training, phishing simulations, spotting AI phishing, reporting and response, identity and access. For every one of them it spells out what good actually looks like and the specific moves that take you from one belt up to the next, so nobody is ever left wondering what to tackle first. Alongside the action plan you get an IT manager's playbook that explains how AI has changed human risk nad what organisations need to look out for in 2026, plus ready-made awareness posters/screensavers you can print or drop straight onto screens, so the message reaches people wherever they happen to be. Best of all, it is built to keep working long after October rather than fizzling out once Cyber Awareness Month is over.
A harder target is a measurable one
What makes all of this worth the effort is that the progress shows up somewhere you can actually see it. As your people work through the plan, fewer of them click a simulated phish while more of them report the real thing. Suspicious emails start getting flagged within minutes rather than slipping quietly through the net. Given a few weeks of steady effort, awareness stops being a once-a-year campaign and settles into a habit the whole organisation shares, which matters enormously for anyone who carries responsibility for security, because it turns awareness from a cost that is forever hard to justify into a story of steady progress you can happily take to the board. That is what being phishing fit really means...
AI may have handed attackers a shortcut, but it has not changed the fundamentals. Well-supported people who know what to look for, backed by regular practice and a plan they can follow, remain the single hardest thing any attacker has to get past.
AI has changed the way phishing works, which makes this Cyber Awareness Month the ideal moment to bring your own defences up to match it. Download the full fight plan toolkit to see exactly where your organisation stands today and the practical steps that will turn your people into a harder target.
