Photo by Christin Hume on Unsplash
There is a safety briefing happening in UK businesses right now that has quietly become wrong. Staff are being told to watch for spelling mistakes, check whether the sender's address looks a bit off, hover over links before clicking. That advice is not incorrect exactly. It is just a few years behind where the threat actually is.
The people sending phishing emails today are not the amateur scammers of 2019. They are using AI tools to generate text that reads cleanly, professionally, and in the exact tone your business uses internally. The spelling is perfect. The grammar is native. The email looks like it came from your accountant, your courier, or your IT provider, because in many cases it is built from real examples of how those people actually write to you.
What changed and why it matters now
For a long time, the rough edges in phishing emails were a genuine tell. A message with odd syntax, a notice that read like it had been translated twice. Employees who knew to look for those signs caught a real proportion of attacks.
That era is over. Generative AI has essentially solved the language quality problem for cybercriminals. Writing a convincing, context-specific email now takes seconds and costs nothing. Attackers can scrape publicly visible information about your business, your team, and your suppliers to make messages feel specific and familiar. The result is that the visual and linguistic cues staff were trained to spot are no longer reliable indicators. An email can look exactly right and still be an attack.
The red flags that actually matter in 2026
That does not mean employees cannot learn to recognise attacks. It means the training needs updating. The behaviours worth teaching your team today look different from a few years ago.
- Urgency and manufactured pressure. A genuine supplier or colleague rarely demands that something be done in the next ten minutes or something bad will happen. That pressure is deliberate, and it works because it short-circuits careful thinking.
- Requests that bypass normal process. A finance team member receiving a message asking to approve a payment via a link, rather than through the usual system, is a warning sign regardless of how well-written the message is.
- Unexpected contact about something sensitive. A message that arrives out of nowhere about a password reset, a delivery nobody was expecting, or an invoice dispute that does not ring a bell deserves a second look even if it reads perfectly.
- Links that do not go where the text implies. Hovering over a link before clicking still matters. What has changed is that attackers are now better at making everything around that link look legitimate.
Why once-a-year training is not enough any more
If your team last did cyber security awareness training a couple of years ago, the content they received was built around a threat landscape that has meaningfully shifted. That is not anyone's fault, but it is worth addressing.
Good training in 2026 needs to go beyond showing people what a phishing email looks like. It needs to get into the psychology of why these attacks work. Why does urgency cause mistakes? Why do people act on authority cues without verifying them? Understanding the mechanism makes staff more resilient to variations they have never seen before, not just the specific examples in last year's training slides.
Training also needs to be ongoing rather than a single annual session. Simulated phishing exercises, short refreshers when a relevant news story breaks, and a clear process for reporting suspicious messages together contribute far more than a once-a-year sit-down. The post on why every person in your business is now on the security frontline covers the wider picture of what that actually means in practice.
The cost of getting this wrong
Business email compromise, which is the category of attack that benefits most from AI-quality writing, costs UK businesses significant sums every year. The attack often involves nothing more technically sophisticated than a convincing email and a member of staff who acts on it quickly. No malware. No hacked account. Just a transfer authorised to the wrong destination, and then the money is gone.
Your firewall, your antivirus, and your patching schedule will not stop that. As one earlier post put it, a firewall will not stop an attack aimed at your finance director when the attack arrives as a convincing request rather than a malicious file.
A practical starting point for small businesses
The right question to ask is whether your current training reflects how attacks actually work today, or whether it is teaching people to spot the threats of three years ago. Those are genuinely different things now.
A structured security awareness training programme will give you a baseline on where your team actually stands, and the better ones combine learning with simulated attacks so you can see how staff respond in practice rather than just in a quiz at the end of a module.
October is Cyber Security Awareness Month, which makes it a natural moment to ask the question: does your team know what to look for in 2026, or are they still looking for the typos? Updating your training does not have to be a major project. It starts with recognising that the goalposts have moved, and deciding to move with them.