'You can no longer spot phishing by grammar mistakes'

Companies and organizations are still not sufficiently prepared for cyberattacks that use AI. Phishing used to be fairly easy to detect, but those days are over. “I see phishing emails that are remarkably well-written and clearly tailored to the recipient, with details that wouldn’t have been included in such a message in the past,” says cyber expert Patrick Jordens. In this episode of Cracked by Jordens, he discusses how cybercriminals are using AI to launch increasingly sophisticated attacks and warns organizations to strengthen their digital resilience.

As a cybersecurity expert, what do you notice about the fact that AI is being used more and more frequently in cyberattacks?

“I see it in the emails I come across and in the way attacks are orchestrated. I also talk to people who are dealing with the consequences. It’s no longer a future scenario; it’s happening right now.”

How exactly do cybercriminals use AI?

“There are roughly two approaches. The first is generative AI—language models used to make phishing emails, CEO fraud (where criminals impersonate the CEO), and social engineering much more convincing. The days of poor spelling and clunky sentences serving as red flags are over. Messages are personalized based on information that’s often readily available online, which makes them far more credible.

The second approach involves using AI to accelerate the attack itself: scanning for vulnerabilities, generating malware variants that evade detection, and, increasingly, creating deepfake audio and video for identity fraud.”

Is AI also becoming more advanced?

“Yes, and the pace at which that’s happening is what concerns me the most. The barrier to launching a credible attack has been drastically lowered. Whereas you used to need technical knowledge to write malware or draft a convincing phishing email, that’s now largely automated. That means not only that targeted attacks are becoming more professional, but also that small-scale, opportunistic attacks have become much more convincing.”

Do you have an example from your own experience?

“The examples I encounter in practice are mainly on the social engineering side. I see phishing emails that are remarkably well-written and clearly tailored to the recipient, with details that wouldn’t have been included in such a message in the past. That points to the use of AI to improve both the text and the personalization.

At the same time, I have to be honest: I usually can’t determine with certainty that AI was used. It’s often impossible to tell from a phishing email or an attack itself whether a language model was involved. What I do see, however, is the trend: attacks are becoming, on average, more convincing and more personalized, and that pattern aligns with the large-scale use of AI.”

How can companies and organizations better protect themselves against AI-based cyberattacks?

“The challenge is that AI primarily exploits the weakest link, and that’s usually not the technology but the human element. Awareness is essential, but it needs to be adapted: people no longer recognize phishing by language errors, so the focus shifts to other indicators, such as an unusual request, an unusual payment instruction, or unexpected pressure to act quickly. In addition, basic security remains just as important. MFA, network segmentation, and patch management haven’t become any less relevant because of AI—if anything, they’ve become more important. Because without those basics, a successful phishing attempt can immediately escalate further.”

Can AI also be used by the ‘good guys,’ specifically to combat cyberattacks?

“Absolutely. AI is widely used in detection and response, for example, to flag anomalies in network traffic, filter out phishing emails, or analyze log files for patterns that a human wouldn’t readily notice. What I do caution against, however, is viewing AI tools as a replacement for basic security rather than a supplement to it. A smart detection system doesn’t make up for a lack of a patch policy or the absence of MFA. AI is a layer in the defense, not the foundation.”

Is there anything else you’d like to share with the reader?

“There’s one more thing I’d like to mention: the discussion about AI in cyberattacks often focuses on the technology behind it, but we must also focus on scale and speed. What used to take hours to write a single convincing phishing email now takes seconds to generate hundreds, each tailored to a different recipient.

Organizations that know where their vulnerabilities lie and how to respond to them have a structural advantage. Anyone who lacks visibility into their own systems, data, and risks is, by definition, vulnerable. And that immediately touches on a persistent misconception: the idea that, as a company, you’re not interesting enough to be targeted. That was already an outdated notion, but with AI, it’s no longer tenable at all. An automated attack doesn’t consider whether a company is interesting; it looks for a weak spot.”