For years, phishing training has taught employees to look for the same warning signs: poor spelling, unusual greetings, mismatched logos, awkward language and emails that simply do not sound like the person who supposedly sent them.
Those clues still have value, but they are becoming less reliable.
Generative AI has made it cheap and easy to produce polished emails, convincing websites, synthetic voices and highly personalised messages. The Australian Signals Directorate says social engineering is becoming easier for malicious actors to use at scale partly because of AI. In FY2024–25, phishing was recorded in 60 per cent of incidents reported to ASD’s Australian Cyber Security Centre. The agency also notes that cybercriminals are using generative AI to create more convincing spearphishing emails and other material designed to impersonate legitimate people and organisations.
For businesses, this creates a problem with the way phishing awareness training has traditionally been approached. Employees can no longer be expected to make good security decisions simply by judging whether an email looks suspicious.
The old red flags are not enough
A phishing email does not need spelling mistakes to be dangerous. It can use the right terminology, refer to a real project and mimic the tone of a normal business conversation.
Attackers can also use information that is already available through company websites, LinkedIn profiles, previous data breaches or stolen email accounts. A message might correctly name a supplier, manager or colleague. It may arrive at a plausible time and make a request that is only slightly different from an ordinary one.
That is why AI-powered phishing changes the training problem. Employees are being asked to distinguish between communications that may be almost identical in appearance. Teaching them to become better at spotting visual mistakes will only go so far.
The more useful skill is knowing when a request requires independent verification.
Train staff to verify the request
A useful training program should identify the requests that carry the greatest risk inside the business.
A supplier asking to change bank details should trigger a verification process. So should an unexpected payment request from an executive, a request for a password or multi-factor authentication code, or a message asking an employee to sign in to Microsoft 365 through an unfamiliar link.
The same principle applies when someone asks for sensitive employee information, customer records or access to a system. If a request involves money, credentials, confidential information or a change to normal procedure, staff should know how to confirm it through a separate channel.
That might mean calling a supplier using a number already held on file rather than one contained in the email. It might mean checking an unusual executive request with another authorised person. The important part is that verification becomes part of the process, not something an employee has to invent while deciding whether a message feels genuine.
Tech Engine’s guidance on building a culture of cyber awareness already emphasises regular training and simple reporting. In 2026, those programs should put more weight on what employees do after they encounter a questionable request.
Phishing simulations should test decisions, not eyesight
Simulated phishing campaigns are useful, but many are still built around deliberately planted clues. The employee notices an odd sender address, finds a spelling mistake and passes the test.
Realistic simulations should be harder in a different way. They should reflect the communications employees actually receive: document-sharing notifications, invoice changes, password resets, HR messages, Microsoft 365 alerts and requests from managers.
The results should also measure more than click rates. Did the employee report the message? How quickly was it reported? Did they use the correct verification process? If a payment change was requested, did finance follow the established control?
Those measures reveal whether the organisation can respond to a convincing attack, rather than whether staff have learned how a training platform designs fake emails.
Different roles need different training
The risks are not distributed evenly across a business. Finance teams approve payments and supplier changes. HR teams hold personal information. IT teams can grant access. Executives are frequently impersonated, while administration staff often communicate with people outside the organisation.
Training should reflect those differences.
An accounts payable employee, for example, needs more practice dealing with altered invoices and banking instructions than someone who rarely handles payments. Tech Engine has covered this problem in more detail in its guidance on AI-powered impersonation and invoice fraud.
Role-specific training makes the exercise more relevant and gives employees a procedure they can use when the same situation appears in their actual work.
Training cannot be the only defence
Even well-trained employees make mistakes. A sensible security program assumes that one message will eventually get through and limits what can happen next.
Email filtering, phishing-resistant multi-factor authentication, appropriate access controls and monitoring all reduce the dependence on a single employee making the right decision. Reporting also needs to be simple. Staff are more likely to raise something early when they know exactly where to send it and do not expect to be blamed for asking.
These controls form part of the wider cyber security services businesses should consider alongside staff education.
What good phishing training looks like in 2026
Effective training is regular, relevant to the employee’s role and based on the kinds of requests people genuinely receive. Staff should know which actions require verification, how to perform that verification and how to report something quickly when they are unsure.
The objective is no longer to turn every employee into an expert at identifying a fake email. It is to make sure a convincing email cannot easily produce a payment, a password, sensitive information or access to the business.
Tech Engine helps Australian organisations improve both the human and technical sides of phishing protection, from staff awareness and Microsoft 365 security to identity controls and ongoing monitoring. Our cyber security Brisbane team can review where phishing risk sits within your environment, while our managed IT services Brisbane offering provides ongoing support for the systems and controls that sit around your people.
