For twenty years the tell was the same: a misplaced comma, a logo slightly off-centre, a sentence that simply read wrong. Phishing gave itself away because the people writing it usually weren’t native speakers, weren’t copywriters, and weren’t paying attention to your company’s internal tone.
That tell is gone.
KnowBe4’s seventh Phishing Threat Trends report, published in April 2026, found that 86% of phishing campaigns its researchers tracked over the previous six months involved AI in some form. The trend line matters more than the number: 80% in 2024, 84% in 2025, 86% now. The holdouts are converting.
Writing a convincing, context-aware phishing email used to cost a skilled attacker hours of research. A language model produces the same email in minutes, with the right tone, the right internal jargon and a sender name that matches someone in your finance department. Harvard Business Review’s research on AI spear-phishing found machine-generated lures achieving click-through rates comparable to human expert social engineers, at a fraction of the cost.
The economics collapsed. A campaign once worth aiming only at large enterprises is now cheap enough to run against a sixty-person startup.
The defence gap isn’t an AI problem
Here is what the arms-race framing misses. The most effective technical control against email impersonation isn’t a new model. It’s an email authentication standard published in 2012 that most organisations still haven’t fully deployed.
DMARC tells receiving mail servers what to do when a message claims to come from your domain but can’t prove it. Paired with SPF, which authorises specific servers to send on your behalf, and DKIM, which cryptographically signs outgoing mail, it closes direct domain spoofing.
The adoption numbers explain the gap. DMARC reached 52% of domains globally in 2025, up from 38% in 2023, largely driven by Google and Yahoo’s 2024 bulk sender requirements. Only 18.4% enforce a reject policy. That leaves roughly a third of DMARC-enabled domains publishing a record that reports spoofing while stopping none of it.
Even at the top of the market, the gap persists. Roughly 31% of Fortune 500 companies were still not at enforcement as of late 2025.
For teams starting from scratch, a DMARC Record Generator is the fastest way to publish a syntactically correct baseline, since a single malformed character silently invalidates the whole policy.
Why so many domains stall in monitor mode
Getting from “we have a record” to “we’re blocking impersonation” is the hard part, and it’s an operational problem rather than a technical one.
It requires parsing aggregate and forensic reports, correctly authorising every legitimate sending source — marketing platforms, CRM tools, invoicing software, HR systems — and tightening enforcement gradually without breaking mail flow.
Most organisations discover they have more sending sources than anyone documented. Tightening too fast means legitimate invoices stop arriving, which is a fast route back to p=none and an indefinite pause.
That’s the real reason so many domains sit in monitor-only. Nobody decided to stop. The next step just kept costing more attention than it got.
What DMARC no longer covers
This is the part the DMARC conversation has not caught up to, and it changes what enforcement buys you.
Attackers largely stopped spoofing domains. KnowBe4 found that 22% of phishing now arrives through legitimate platforms — Google, Microsoft, SharePoint and similar — so the message inherits that platform’s authentication and lands cleanly. The consequence is stark: roughly 84% of successful phishing now passes DMARC.
Of phishing that gets past gateways, KnowBe4 attributes 61.2% to compromised business accounts, including 11.4% from trusted supply-chain partners, and 27.6% to webmail providers like Gmail and Outlook. Only 13.6% comes from dedicated phishing domains.
Read those together, and the picture is clear. A message sent from a genuinely compromised Microsoft 365 account is authenticated because it is authentic. The sender is real. The domain is real. The signature validates. Everything DMARC checks comes back correct.
This does not make DMARC optional. Domains at enforcement experience substantially fewer spoofing incidents, and the 13.6% that still comes from lookalike domains is precisely what DMARC blocks. It does mean “does it pass authentication” has stopped working as a standalone signal.
The controls that address the remaining majority are different: credential protection, session and token monitoring, anomaly detection on internal sending behaviour, and out-of-band verification for anything moving money. Attackers now automate credential harvesting and use, and AI-driven credential attacks compress the interval between compromise and exploitation to something no manual review catches.
Internal impersonation reflects the same shift. KnowBe4 saw it in 30% of attacks from threat actors in the first quarter of 2026. An email from a colleague’s real account, written in their voice by a model that read their sent folder, defeats every heuristic an employee was trained on. That category of underestimated AI threat is where verification through a second channel stops being bureaucratic and starts being the control.
Where AI genuinely helps defenders
There’s a quieter AI story on the defensive side.
Interpreting DMARC aggregate reports traditionally required manual log analysis to separate legitimate third-party senders from actual spoofing attempts. Modern DMARC platforms use automated analysis to flag anomalous sending sources, suggest SPF and DKIM adjustments, and model the impact of stricter enforcement before you commit to it.
That collapses a process which used to take security teams weeks into something closer to hours. It is unglamorous automation: not generating better attacks, but making defensive configuration less error-prone for teams without a dedicated email security specialist.
Behavioural detection is where the newer work sits. Systems that learn normal internal sending patterns can flag a finance account suddenly emailing thirty external recipients at 2 am, which is the class of signal authentication cannot produce.
Where to start
For any organisation that hasn’t reviewed its DMARC configuration recently, the sequence is straightforward and mostly free.
- Generate a correct baseline record and publish it in monitor mode.
- Read the reports for several weeks before tightening anything. Expect to find sending sources nobody documented.
- Authorise legitimate senders one at a time, confirming mail flow after each.
- Move to quarantine, then reject, with a rollback plan.
- Then address the other 84%. Credential protection, MFA that resists interception, monitoring of internal sending behaviour, and a verification step for payment changes that doesn’t rely on email.
That last item is the one most organisations skip, and it is now where most successful attacks land.
The bigger point
AI erased the visual and linguistic cues that used to flag a phishing email. Domain authentication stopped being a compliance checkbox in that moment and became infrastructure.
It also stopped being sufficient in the same moment, because attackers read the same reports you do and moved to sending from accounts that authenticate legitimately.
Finish the DMARC deployment. Most organisations have not, and the 13.6% it still blocks includes the brand impersonation that damages customers rather than just employees. Then build for the reality that the majority of what reaches your inbox will arrive fully authenticated, from a real account, written by something that has read enough of your company’s email to sound exactly like it belongs.
Related: AI Hackers Stole 23,800 Credentials in Just 6 Hours
