Why do we keep testing employees for yesterday’s phishing attacks
“Yesterday’s price is not today’s price,” a phrase Fat Joe popularized in 2021 , reminds us that what worked yesterday may not deliver the same value today. In cybersecurity, this matters when we continue to assess employees against familiar phishing techniques while attackers use AI to craft more convincing, personalized messages. Having conducted multiple phishing simulations and one in October, 2026, I believe we need to ask a harder question: are we preparing people for the phishing attacks they are likely to face today, or testing their ability to recognize or remember the warning signs we have taught them to expect? What happens when those warning signs don’t apply or they face novel attacks? AI -enabled “phishing landscape” The traditional tell-tale signs of phishing which we used to train employees for are becoming less dependable. Generative AI can help attackers produce convincing messages, personalize lures and improve the quality of their communication. This does not mean e