Most email defenses still do the job they did a decade ago. Scan the message, look for something malicious, block it. That worked when the danger sat in the payload, a bad link or an attachment. It stopped working when the danger moved into the message's intent, and it is failing now that the sender is no longer a person.

From Bad Content to Bad Intent to AI on Both Sides

Phishing 1.0 was bad content. Malicious links, infected attachments, spam. Secure email gateways were built for this. Scan the message, match the signature, drop the bad stuff. That era is largely handled.

Phishing 2.0 is bad intent. Business email compromise, executive impersonation, fake invoices, wire fraud. There is no malicious payload to scan, only social engineering that reads as a normal request from a person you trust. Gateways are blind to it because there is nothing in the content to flag. Behavioral analysis is the only thing that catches it, which is why some of us have spent the better part of a decade building AI that learns how your people actually communicate.

Phishing 3.0 is AI-powered and multi-channel. GenAI writes the lure. Deepfakes carry it into voice and video. The campaign spans email, collaboration tools, and live calls. The attacker is no longer a person typing. It is increasingly an agent that researches, drafts, sends, and adapts on its own.

The third stage changed the economics of attacking you.

The Attacker Now Runs an Agent

Reconnaissance used to cost an attacker time. A human had to read your website, scrape job postings, map your suppliers, and study a few executives on social media before writing something believable. Agentic AI removes that cost. An agent can summarize your public footprint, pull from GitHub and cloud documentation, identify who reports to whom, and generate a target-specific pretext in seconds, then do it again for the next 10,000 organizations.

The quality of the lure goes up. The clumsy, misspelled phish is retiring, replaced by interactive lures that hold a conversation. Microsoft has tracked phishing platforms that generate tens of millions of messages a month [3], and in a 2026 Dark Reading readership poll, 48% of security professionals ranked agentic AI as the top attack vector for the year, ahead of deepfakes and every other option [4].

The blast radius widens too. You no longer have to be a high-value target to get a tailored attack. When reconnaissance is free, every organization is worth personalizing, and the small teams that assumed they were too minor to bother with get swept into automated campaigns that arrive looking hand-crafted.