You open your inbox and see an email from your CFO, subject line "Quick favor before my flight." The signature looks right. The tone sounds right, even a little rushed, the way it always is when she's about to board. She needs a vendor payment sent today, details attached. You almost click through before you notice: this isn't how she usually asks. You call her direct line. She has no idea what you're talking about.

That is what a modern attack looks like when it reaches you, not a bad-grammar scam you can spot in two seconds, but a message built to survive exactly the kind of scrutiny you'd normally give it. Here is what is driving your inbox today, and why the old advice to "just look for red flags" no longer holds up.

Phishing still leads, but it doesn't look like phishing anymore

Malicious email and phishing together now account for half of all ransomware incidents, according to Sophos's 2026 State of Ransomware report. These are not the obvious scams of a few years ago. Attackers now research their targets, mimic real communication styles, and time messages around plausible events, an invoice, a shipping delay, a password reset.

Business email compromise targets people, not systems

Business email compromise, or BEC, is a scam where attackers impersonate an executive or vendor to redirect a wire transfer or steal sensitive information. CISA has tracked a steady rise in this tactic for years, and it remains effective because it exploits trust and urgency rather than a technical flaw. There is often no malicious link or attachment to catch. Just a convincing request from someone the employee believes they know.

→Watch Cyber Attacks

Account takeover starts with a stolen identity

Once an attacker has a working set of credentials, they do not need to break in. They log in. Compromised identities are now behind the majority of ransomware attacks, which is why multi-factor authentication and identity monitoring matter as much as any email filter. A stolen password that goes unnoticed can sit active in your systems for weeks before anyone realizes something is wrong.

AI is making all of this harder to catch

AI has removed most of the tells that used to give scams away. Grammar is clean, tone matches the impersonated sender, and voice cloning can now recreate an executive's voice convincingly enough to pass a phone call. What used to take a skilled attacker hours to craft can now be generated in seconds, which means the volume of convincing attempts is climbing right alongside the quality.

See how ready your team really is on September 16

Technology stops a large share of these attempts before they ever reach an inbox. But no filter catches everything, which means your employees are still the last line of defense. A team that knows how to pause, verify, and report a suspicious request closes the opening that even the best tools leave exposed. That is exactly what Infoadvantage will cover in depth at Think Before the Breach: Building a Cyber-Aware Workplace on September 16.

Register now to save your seat.

FAQ: Understanding Today's Threats

Why do phishing emails look so much more convincing now?

Attackers use AI to research targets and write clean, well-timed messages that mimic real communication styles. The obvious red flags of a few years ago, like poor grammar, are largely gone.

What makes business email compromise different from regular phishing?

BEC relies on impersonation and urgency rather than malicious links or attachments, which makes it harder for technical filters to catch. It targets trust between people, not a flaw in a system.

How does an account takeover happen?

An attacker gets a working username and password, often through a phishing attempt or a data leak, and simply logs in like a legitimate user. Without multi-factor authentication, there is often nothing stopping them once they have the credentials.

Can AI-generated scams really be that convincing?

Yes. AI can now clean up grammar, mimic writing style, and even clone a familiar voice closely enough to pass a phone call. The tells people were trained to look for are disappearing.

If technology can't catch everything, what helps?

Employee awareness training that teaches people to pause and verify unusual requests, combined with multi-factor authentication and layered technical defenses, closes most of what any single tool leaves exposed.