One of the most pressing challenges in cybersecurity is the rise of AI-driven phishing campaigns. Recent findings from Hoxhunt reveal that artificial intelligence is now outpacing human red teams in developing more sophisticated phishing attacks.
As these attacks become increasingly personalized and effective, it is crucial for organizations worldwide to understand the profound impact of AI’s role in cyber threats. This understanding is vital for developing strategies to counteract these advanced threats and protect sensitive information.
The rise of AI in phishing
According to Hoxhunt’s study, AI-driven phishing attacks have significantly improved in effectiveness over the past few years. The research highlights that AI agents, which were previously 31% less effective than human red teams in 2023, have now become 24% more effective by March 2025. This dramatic improvement underscores AI’s ability to scale attacks and adapt to defensive measures far faster than traditional methods.
“AI attack agents can operate at scale and never need to sleep, so if the goal is breadth versus depth, AI will tend to perform better,” explained Casey Ellis, Founder at Bugcrowd. His comments reinforce the notion that while humans are creatively adaptive, AI excels in its ability to continuously scale and launch phishing campaigns across large numbers of potential targets.
Personalized attacks at scale
One of the most significant advantages of AI-powered phishing is its ability to craft highly-personalized attacks. Unlike human attackers, AI can generate hundreds of unique phishing emails tailored to specific individuals or organizations, increasing the likelihood of success. As the study revealed, AI’s success rate in phishing campaigns has climbed steadily, with a failure rate of 2.78% in March 2025, just behind the 2.25% failure rate of human red teams.
These advancements are particularly concerning because AI-generated phishing attacks are not just more abundant—they are also more effective. As Amit Zimerman, Co-Founder and Chief Product Officer at Oasis Security, pointed out, “As adversaries become more sophisticated, organizations must adopt AI-driven offensive cybersecurity to stay ahead, making AI not just a convenience, but a critical asset for maintaining a competitive edge in security.”
The human element in cybersecurity
While AI is playing a growing role in cyber threats, human expertise remains indispensable. Human defenders are still vital for interpreting AI-driven attack results, identifying subtle vulnerabilities, and understanding complex threat landscapes that AI might miss. Zimerman emphasized the need for human oversight: “Human expertise is necessary to interpret complex results, make critical decisions, and apply context-specific reasoning.”
The role of human intuition becomes especially apparent when it comes to the nuance of certain vulnerabilities and attack scenarios that require contextual understanding. Stephen Kowski, Field CTO at SlashNext, said, “AI enhances speed, efficiency, and coverage in offensive cybersecurity operations. However, human expertise remains crucial for interpreting results and making strategic decisions.”
AI in offensive cybersecurity
As AI evolves, its role in offensive cybersecurity has also expanded. Offensive cybersecurity involves proactive measures where security teams mimic the tactics of real-world attackers to uncover vulnerabilities within a system. With AI, these simulated attacks can be scaled, tested across large infrastructures, and executed with greater speed and accuracy.
Satyam Sinha, CEO and Co-Founder at Acuvity, noted, “The field of AI has seen massive leaps over the last two years, but it is evolving with new developments every month. Enterprises must consider approaches to bridge the gap with specialized learning programs or certifications to aid their cybersecurity teams.”
This shift toward AI-driven offensive cybersecurity isn’t just about mimicking attacks but about being proactive in anticipating them. AI’s ability to process vast amounts of data allows security teams to identify weaknesses quickly and act before an actual attack can occur. However, this shift is not without its challenges, as Zimerman points out: “AI can process vast amounts of data, identify potential weaknesses, and execute a variety of attack simulations across different environments simultaneously. This not only enhances productivity but also ensures more comprehensive coverage, leaving fewer blind spots for potential threats.”
The future of AI-driven cybersecurity
The rise of AI-powered phishing and offensive cybersecurity is a double-edged sword. While AI enhances defenders’ capabilities, it also provides attackers with more sophisticated and scalable tools. This evolving threat landscape requires organizations to adapt quickly and integrate AI tools into their cybersecurity defenses.
Nicole Carignan, Senior Vice President at Darktrace, stresses the importance of securing AI systems themselves: “Understanding the evolving threat landscape and the techniques adversaries are using to manipulate AI is key and critical for defenders to be able to test these use cases against their own models to effectively secure their AI systems and defend against AI attacks.”
As AI systems become more integrated into everyday cybersecurity tools, it’s clear that human oversight will be essential to ensure these technologies are used responsibly and effectively. Transparency and explainability in AI outcomes are key to fostering a productive human-AI partnership, a sentiment echoed by Carignan: “Transparency and explainability in the AI outcomes are critical to foster a productive human-AI partnership.”
The growing prominence of AI in phishing attacks presents a formidable challenge for organizations looking to safeguard their networks. Hoxhunt’s research highlights the tremendous advancements made by AI in creating scalable, personalized phishing campaigns. However, as cybersecurity professionals like Amit Zimerman and Stephen Kowski emphasize, AI is not a replacement for human expertise. Instead, it should be seen as a tool that, when paired with human intuition and oversight, creates a robust defense against evolving threats.
AI is not just shaping the future of cybersecurity—it’s already here, reshaping how attacks are carried out and how we defend against them. As organizations brace for this new era of AI-driven cyber threats, it will be crucial to strike the right balance between automation and human expertise, ensuring a comprehensive and adaptive defense strategy.
Follow SecureWorld News for more stories related to cybersecurity.