AI is now much better at phishing than humans: Can we protect ourselves?

Artificial intelligence has officially surpassed human experts in one of cybersecurity’s most concerning areas: phishing. According to a new report by Hoxhunt, AI-generated phishing emails are now 24% more effective than those created by elite human red teams, marking a dramatic shift in the threat landscape. What once took teams of experienced social engineers is now being done faster and more efficiently by AI models trained to exploit human behavior.

AI’s rapid rise in phishing capabilities

Just two years ago, AI was 31% less effective than humans at phishing simulations. But thanks to advances in large language models and targeted data usage, AI not only closed the gap — it has now overtaken top-tier human attackers. Hoxhunt’s AI spear phishing agent, codenamed “JKR”, showed this leap by generating context-aware, highly convincing emails that tricked users more successfully than those crafted by professionals.

Between 2023 and 2025, AI’s phishing performance relative to human red teams improved by 55%, a number that highlights the urgency of updating security strategies. “The big bad AI wolf is knocking at the door,” warned Hoxhunt’s CTO, Pyry Åvist.

Reinventing cybersecurity with AI-powered defense

To fight AI, we must use AI. Traditional awareness training is no longer enough. Organizations need adaptive, behavior-based systems powered by AI that can detect and counter increasingly sophisticated phishing attempts. As Hoxhunt’s CEO Mika Aalto put it, “We need to build the immune system for people and the digital environment.”

This turning point resembles the birth of antivirus in the 1980s — but now, it’s people who need protection, not just machines. AI can be both the threat and the solution.