Ran an internal AI phishing test using publicly available tools and I am not ready to share the results with my manager

Used a combination of LinkedIn scraping and a basic LLM prompt to generate spear phishing emails targeting ten people in our finance and operations teams. Took about 40mins to build the context for each target. The emails referenced real projects, real colleague names, real vendor relationships pulled from public sources.

Seven out of ten people interacted with the test email in some way. Three of those would have resulted in credential submission based on what they clicked.

Our security awareness training was completed by all ten of them in the last six months. The training is built around identifying suspicious characteristics but the emails I generated had none of the characteristics the training describes because I specifically avoided all of them.

I do not know what the right training curriculum looks like when the threat has evolved past what the curriculum was designed to catch. Sitting with that one before I figure out how to present it.