Microsoft published a number in April that changed how I talk about phishing: when attackers use AI to write the email, click-through hits 54%. Ordinary phishing sits around 12%.
Same attack. Four and a half times the hit rate. And according to Microsoft's own researchers, that gain isn't from sending more email — it's from precision.
Picture what that means for a wealth management firm. The old phishing attempt was easy to spot: odd grammar, generic greeting, a vague urgent wire request. The new one names your custodian, references a transfer your client actually discussed last week, and sounds like the person it claims to be from. Written in seconds, for pennies.
Your team won't catch that one. Mine wouldn't either. "Train people to spot it" was always half an answer. It's less than half now.
What still holds up: phishing-resistant sign-in, so a stolen password alone buys an attacker nothing. A hard rule that every wire instruction gets confirmed on a number you already had — never the one in the email. And monitoring that flags an advisor signing in from a place they've never been.
One compromised inbox at an advisory firm isn't an IT incident. It's the call to a client whose money moved, and a very uncomfortable conversation at your next insurance renewal.
Worth pressure-testing before that renewal comes up.
Want the next one in your inbox?
One practical Microsoft 365, Copilot, Azure, or security move per week — plain English, no pitch.
Subscribe via email