What to do instead — and where cybercrime is actually heading in 2027.
For fifteen years, the advice has been the same: look for the misspelling, check the sender address, be suspicious of artificial urgency.
That advice is quietly expiring.
A field study published this year measured what it costs to produce a personalized, individually researched phishing email aimed at one specific person: about three cents and 45 seconds. A skilled human takes roughly seven minutes.
The finding that matters isn't that AI writes better phishing emails — it doesn't, at least not yet. It's that the economics have completely changed. A forty-person company may not have been worth seven minutes of a criminal's time. It is easily worth 45 seconds of a computer's.
And increasingly, the attacks costing small businesses money never reach an employee at all. In cyber insurance claims published this year, 39% of funds-transfer fraud events involved no email compromise anywhere in the chain. Nobody on staff was ever in a position to catch those, no matter how well trained.
So this session took on the harder question: if your people can no longer serve as your primary detection layer, what actually protects you?
What this session covered:
What it costs to attack you now, and why "we're not a target" stopped being true
A live voice clone — Delcie cloned his own voice on the spot and used it to request a wire transfer approval
Two widely repeated cybersecurity statistics that aren't real, including one that was formally retracted
Where this is heading in 2027, and why it isn't more phishing
The five decisions that can make an attack not matter — mostly configuration and process, not new products
Takeaway
Awareness training was built for a threat model that no longer holds. When a targeted phishing email costs three cents to produce, every business is worth attacking, and when nearly 40% of funds-transfer fraud never touches an employee's inbox at all, no amount of training puts your people in position to catch it. The fix isn't better training or another product — it's a small set of configuration changes and process rules that hold whether or not anyone spots the attack. The recording walks through all five, plus the one-page test for evaluating the AI tools already running inside your business.
Watch the webinar recording below
