Phishing isn’t new, but the tactics du jour have evolved over the decades to evade detection—from those easy-to-spot, typo-filled emails to more advanced, highly personalized, multi-channel messages. And now AI has changed the pace. Okta Threat Intelligence saw a 136% jump in voice-related phishing attacks in a single month. Attackers are moving fast, in part because they can now use AI to easily spin up their own phishing infrastructure.
“This is removing a point of friction for attackers,” says Charlotte Wylie in a recent conversation for our Executive Exchange series. “They don’t have to go out and purchase these [phishing] kits; they can vibe code them themselves.” That means they can execute more attacks, at speeds defenders may not be ready for.
In today’s world, where AI-augmented phishing attacks abound, MFA isn’t enough to protect your business. So what should a CISO actually do about it? Wylie suggests three steps:
Get people enrolled. Make sure employees have phishing-resistant options like passkeys or Okta Fastpass in place.
Enforce it. Enrollment alone isn't enough. The policy has to require it.
Close the back door. Stop attackers from switching to a weaker login method once the strong one is in place.
Wylie also makes the case that this is the moment to bring the whole business along. "Everyone understands the safety protocols that we need to put in place to safely use and adopt AI," she says. That shared understanding is a big opening for security teams, but only if they take time to understand where employees may be running into friction.
Want the full picture? Watch the complete conversation with Charlotte Wylie above for her take on reaching maximum phishing resistance, helping ensure security moves at the speed of AI, and balancing friction and security.
