Jordan Polasek · Founder, BVTech LLC · May 17, 2026 · 11 min read
A quieter week on the CISA KEV front, which gives me space to write about something I have been wanting to address for a few weeks now: AI-driven phishing. The headline number — that 41 percent of SMB cyberattacks in 2025 were AI-driven, per VikingCloud's widely-cited research — has been making the rounds in industry coverage. The number sounds dramatic, but the underlying mechanics are worth understanding because the defenses that worked in 2022 do not work anymore.
Let me show you what an AI-driven phishing attack actually looks like in the wild, why your existing anti-phishing training is probably failing against it, and the four concrete changes that still work in 2026.
A few years ago, the typical phishing email had tells. Stilted English, off-brand logos, weird grammar, an obvious sense of urgency. Mediocre criminals wrote mediocre emails, and the running joke at security conferences was that Nigerian princes were the canary in the coal mine of email hygiene.
That era is over. The tooling I have seen in incident response over the last twelve months produces phishing emails that are flawlessly written in business English, perfectly branded to whatever vendor or executive they are impersonating, and contextually specific to the target — the attacker AI has scraped LinkedIn, the company website, recent press releases, and probably a leaked email or two, then generated a message that references specific projects, specific people, and a plausible reason for the request.
Three observations from the trenches:
Last month — anonymized, but accurate in every operational detail — a 20-person law firm in San Antonio got an email purportedly from a partner who was on vacation in Costa Rica. The email asked the accounts-payable clerk to wire $47,000 to a vendor they had used before. The email referenced the actual vendor by name, the actual ongoing matter the vendor was working on, and the partner's actual personal mobile number for follow-up questions.
The clerk, perfectly reasonably, called the mobile number. A voice that sounded exactly like the partner — because it was a clone trained on his bar association podcast appearance — answered, confirmed the wire request, and walked her through urgency. The wire went out.
It was reversed forty-eight hours later, because BVTech happened to be running domain-based authentication on the inbound mail flow and one of our flags caught a mismatched From-header anomaly two days after the fact. The firm got the money back through their bank’s fraud department; the partner had to explain to his bar association that his voice had been cloned without consent. Both outcomes were lucky.
The standard KnowBe4-style training that most small businesses run — "click this link if you think this email is phishing" — was designed for the 2018 threat landscape. It teaches users to look at surface-level cues: typos, weird domains, unusual greetings, etc. Against AI-generated phishing, those cues are gone. The training is not wrong, but it is no longer sufficient.
What is actually still effective is what I call protocol training rather than spot-the-fraud training. The shift is from "learn to recognize a bad email" to "learn to verify a request through an out-of-band channel before acting on it."
Concretely, here is what BVTech rolls out to every Texas client to defend against AI-driven phishing:
These four together knock the AI-driven phishing problem down to a residual small percentage. They do not eliminate it — nothing eliminates social engineering completely — but they make the cost of attack high enough that the criminal economy moves on to softer targets.
The voice cloning question is one I get a lot. Yes, it is real. Yes, it works astonishingly well with very little training audio — fifteen seconds of clean speech is now enough. No, there is no good technical defense against it on the receiving end of a phone call.
The mitigation is operational: any voice call that triggers a financial action requires a callback to a known number. Not the number the caller is using. The number in your CRM, vendor list, or HR system. The minute you pick up the phone and dial out, the cloned-voice scam falls apart, because the attacker does not control the inbound line.
Tell your AP clerk this. Tell your bookkeeper this. Tell your office manager this. Write it down. Test it.
I am going to repeat something I have said in three of the last six recaps because it keeps being true. The Texas small businesses that get burned by AI-driven phishing are not the ones who failed to invest in cutting-edge security tooling. They are the ones who never wrote down their financial-action verification protocol, never enforced DMARC, never trained their AP clerk on out-of-band verification.
The fixes are operational, not technical. They are cheap. They work. They take a Tuesday afternoon to implement.
BVTech ships the DMARC enforcement, the impersonation protection setup, the written verification protocols, and the quarterly training as part of every managed-services engagement. We will also run the project on a fixed-fee basis if you just want the hardening without ongoing management. Call (210) 538-3669 or email [email protected]. The conversation is free, and the cost of the project is dramatically less than the average wire-fraud incident.
— Jordan Polasek is the Founder and Managing Partner of BVTech LLC, a Texas-based managed IT services provider. He holds AWS and 1Password certifications, the Certified Polysomnographic Technologist credential (CPSGT #294), and won the SuperOps Solo MSP of the Year Award in 2023. Connect with Jordan on LinkedIn or at jordanpolasek.com.
EN
ES