Five years ago, spotting a phishing email was straightforward. Dodgy grammar, strange sender addresses, requests from Nigerian princes. Your staff could laugh them off. That era is over.
Phishing has industrialised. Criminal groups now operate like software companies, complete with subscription services, customer support, and regular product updates. They use artificial intelligence to craft messages that sound exactly like your bank, your supplier, or your CEO. And they're targeting Australian small businesses with alarming precision. This shift means updating your approach to simulated phishing attacks and email security testing is a simple but important next step.
What Actually Changed: The PhaaS Business Model
PhaaS stands for Phishing-as-a-Service. Think of it like Canva, but for criminals. Instead of designing flyers, subscribers get ready-made phishing kits complete with fake login pages, email templates, and hosting infrastructure. Monthly fees can start as low as $40 AUD. Many platforms even include customer support and regular software updates to ensure their kits remain effective.
The Australian Cyber Security Centre has flagged social engineering as a major threat to local organisations, with AI making these attacks harder for employees to spot. The numbers back this up. ScamWatch recorded nearly $100 million in losses from phishing-specific scams in 2025, as part of over $2 billion in total losses across all scam types, and the trend line keeps climbing despite years of awareness campaigns.
These platforms have lowered the barrier to entry for cybercrime to almost nothing. A teenager with a credit card can now run sophisticated phishing campaigns that would have required a team of specialists just a few years ago.
How AI Rewrote the Phishing Playbook
The old approach to phishing was spray and pray. Send millions of identical emails, hope a few people click. AI changed the economics completely.
Modern phishing campaigns can now:
- Scrape LinkedIn to identify your staff, their roles, and who reports to whom
- Generate personalised emails that reference real projects or recent company news
- Match the writing style of specific executives by analysing their public communications
- Translate messages into perfect Australian English (no more "kindly do the needful")
- A/B test subject lines and refine messaging based on what gets clicks
Research into why people fall for phishing attempts shows that personalisation dramatically increases success rates. When an email mentions your actual supplier by name, references a real invoice, and arrives at 9:15am on a Monday (peak email-checking time), even careful employees get caught out.
The rise of generative AI has made this worse. Attackers no longer need writing skills. They describe what they want and AI produces polished, convincing copy in seconds.
Why Traditional Cyber Security Education Falls Short
Most security awareness training follows a predictable pattern. Annual presentation, maybe a quiz, perhaps a certificate for the compliance folder. Staff sit through it, tick the box, and promptly forget everything.
This approach made sense when phishing emails were obvious. A yearly reminder to watch for spelling mistakes and suspicious links was enough. But when attackers use AI to craft messages indistinguishable from legitimate business communications, that annual refresher becomes almost useless.
The problem is memory decay. Local research from Monash on phishing awareness suggests that the impact of training often fades if it isn't reinforced regularly. Staff might recognise the examples shown in training, but real attacks look nothing like those sanitised examples.
Simulated Phishing Attacks: Training That Actually Works
The most effective cyber security education happens in context. When someone clicks a simulated phishing link and immediately sees feedback explaining what they missed, that lesson sticks. It's the difference between reading about how to ride a bike and actually falling off one.
Email security testing through simulated attacks creates a useful learning curve. The slight embarrassment of falling for a fake phish motivates people to pay closer attention next time. And because simulations can run continuously, staff get regular practice rather than a single annual event.
Studies of phishing simulations at a major hospital with over 6,000 staff found that while generic phishing had a 7% click rate, customized attacks tailored to the staff had a 55% click rate.
What Good Simulations Look Like
Effective simulated phishing attacks share several characteristics:
- They mirror real threats targeting your industry
- They adjust difficulty based on each employee's past performance
- They provide instant, specific feedback when someone clicks
- They run regularly enough to build lasting habits
- They generate reports showing improvement over time
The goal isn't to catch people out or embarrass them. It's to give staff safe practice recognising threats before real attackers test them.
Getting Started Without IT Expertise
If you're running a small business without dedicated IT staff, the idea of setting up phishing simulations might sound complicated. It doesn't have to be.
Modern platforms handle the technical work automatically. You add employee email addresses, pick how often you want tests to run, and the system does the rest. AI researches your organisation to create relevant scenarios. When someone clicks, they get immediate training. You get a dashboard showing how your team is tracking.
The time investment is minimal. Setup takes minutes. After that, the system runs itself, sending you notifications when something needs attention.
What This Means for Your Business
Phishing has industrialised, but your defence doesn't need to be complicated. Regular simulated phishing attacks give your staff practice recognising threats in a safe environment. When the real thing arrives (and it will), they'll be ready.
The cost of not training is high. A single successful phishing attack can lead to ransomware, data breaches, or business email compromise. Australian businesses face mandatory reporting requirements under the Notifiable Data Breaches scheme, plus the reputational damage that follows.
Want to see how your team would perform? Start free and send yourself a test phishing email. It takes about two minutes, and you'll immediately understand why this matters.
