Businesses need staff to trust normal communication without second-guessing every email, message or phone call. The challenge is that AI can make social engineering more polished, more personalised and potentially capable of adapting as the conversation develops.
For years, staff awareness training has focused on familiar clues: spelling mistakes, strange wording, suspicious links, unexpected attachments and senders that do not quite look right.
Those checks are still worthwhile. But businesses can no longer assume that a well-written message is a trustworthy message.
Generative AI can help create polished language, process publicly available information quickly and tailor communication to the context of a particular person or organisation.
AI-powered phishing is social engineering where artificial intelligence assists with activities such as researching a target, producing convincing messages, personalising an approach or supporting later stages of an interaction.
The Australian Signals Directorate describes social engineering as an attempt to persuade people into actions such as revealing credentials, transferring funds, opening files or disclosing sensitive information.
AI is not creating the need for cyber resilience from scratch. Email compromise, identity fraud and manipulated payment requests are already affecting Australian businesses. AI matters because it may help some attackers operate faster, personalise their approach and make their communication more convincing.
Phishing is also only one part of the wider exposure businesses need to think about. Accounts, email, cloud services, devices, suppliers and business processes can all create opportunities for attackers. We explore that wider picture in The 30 most common attack surfaces facing small businesses .
Recent research is exploring how generative and agentic AI could support more adaptive forms of phishing. Public information about a person, company, supplier or role can potentially help attackers make an approach feel more relevant.
That does not mean every phishing campaign is suddenly autonomous or conversational. It does mean businesses should prepare for attacks where convincing language and relevant context are easier for attackers to produce.
Research example: Context-Aware Spear Phishing
Staff should still pay attention to suspicious senders, links, attachments and language. The difference is that those clues should no longer be the only line of defence.
When a request becomes unusual, businesses need a clear point where staff stop following the conversation and independently verify what they are being asked to do.
MFA, account security, clear approval processes and staff reporting pathways all still matter. They are also among the common cybersecurity gaps we see in small businesses , which is why phishing resilience is rarely just a training problem.
The Beach Geek™ helps businesses look beyond individual security products and understand where cyber risk intersects with everyday business processes.
That means looking at where important requests arrive, who has authority to approve them, how identity is verified, how accounts are protected and whether staff know what to do when something feels wrong.
Technology controls matter. So do people and process. That broader view is part of building genuine cyber resilience rather than relying on one security product or one staff awareness rule.
In many cases, AI is better understood as an accelerator of existing risks rather than an entirely new category of attack.
That is useful context for small businesses because it means the fundamentals remain important: strong account protection, sensible verification processes, staff education, monitoring and a clear response pathway.
AI-assisted phishing is one part of a broader cyber resilience challenge. These related guides explore some of the other practical areas worth reviewing.
AI may change how quickly and convincingly attackers communicate. Your response does not need to become complicated. Start with stronger verification habits, secure accounts, practical staff education and clear processes for unusual requests.
This article provides general cyber security guidance. Phishing and social engineering techniques continue to evolve, and each organisation should assess controls in the context of its own people, systems, data and business processes.