AI Accelerates Phishing and Deepfakes: 86% of Attacks in 2026 are AI-Driven

The evolution of social engineering: the impact of artificial intelligence on corporate defenses

Artificial intelligence is revolutionizing social engineering, breaking down the cost, time, and skill barriers that once forced attackers to choose between volume and precision. Today, a single operator can launch large-scale spear phishing campaigns with unprecedented levels of personalization, combining information from organizational charts, public repositories, and employees' social profiles.

Quick Answer

Attack techniques accelerated by AI

According to a KnowBe4 study, 86% of the phishing attacks analyzed in 2026 were AI-driven. These attacks exploit AI's ability to generate personalized messages for hundreds of recipients simultaneously, combining information from various sources both internal and external to the organization.

Another growing attack vector is smishing, or phishing via SMS. The Verizon 2026 Data Breach Investigations Report reveals that people are up to 40% more likely to fall victim to social engineering via text or phone compared to email. This is because text messages lack the authentication infrastructure present in emails.

Deepfakes represent another significant risk. While creating convincing fakes once required advanced editing skills, today a few seconds of audio or video are enough to generate a deepfake. These are often used in the final stage of an attack when a suspicious employee receives a call from a familiar voice to verify a payment request.

The critical aspect of identity

The common thread of these techniques is that the attacks focus on identity rather than malware. A false request to the helpdesk built on real internal knowledge is difficult to detect, even for trained experts. This approach exploits the inherent trust employees place in interactions with their colleagues and internal procedures.

Why traditional detection solutions can't keep up

Traditional detection solutions were based on a fundamental assumption: that attackers' output was limited by human effort. Email filters based on signatures, rule-based anti-fraud engines, and static awareness programs relied on attack patterns changing slowly enough for defenders to adapt.

AI has broken this assumption. When attackers regenerate lures, domains, and payloads at machine speed, trying to match known artifacts becomes a losing battle. Defenders need detection solutions that reason about behavior, not wait for a pattern they've seen before.

Restructuring defenses to adapt

Countering AI-powered social engineering isn't a problem that can be solved with a single product. It requires a shift in operational model, with some key capabilities making it possible. Among these, behavioral analytics based on unified telemetry, which allows detecting suspicious activities such as a legitimate access followed by an unusual OAuth consent grant, an early indicator known of compromise.

Another crucial capability is agentic investigation and response, which uses generative AI to correlate signals into prioritized attack narratives. This allows analysts to elevate their role, reading the summarized case, verifying the reasoning, and approving the response.

Finally, it is essential that the AI used for defense is transparent and agnostic. When AI makes decisions about identity-based attacks, the security team should be able to see the prompts and reasoning behind each decision. If it cannot be audited, it cannot be defended.

The new economy of social engineering

The economy of social engineering has changed radically. Reconnaissance, personalization, and impersonation are now economical, fast, and accessible to any adversary. Defenses built for a slower era desperately need an update.

To delve into detection priorities and defense strategies, a comprehensive guide is available on how to defend against AI-powered social engineering attacks.