Why Phishing Awareness Needs to Last All Year: What to Expect in 2027
Cyber Security Awareness Month is over, but attackers don’t work to a calendar. Here’s what to expect from phishing in 2027, and the four requests employees should always check before they act.
Every October, organisations remind employees how to spot phishing. Staff sit through a refresher, a few reminders go round, and then November arrives and attention moves on.
Attackers don't work to that calendar, and the warning signs employees were taught to look for are becoming less reliable. Spelling mistakes and clunky formatting are easy to fix. What's harder to disguise is what the message is asking someone to do.
A convincing phishing attempt can come from a familiar name, arrive through a channel people use every day, and carry just enough urgency to get someone to act before they think.
How the threat is changing
In Norway, the National Security Authority (NSM) has raised the national cyber risk level to four out of five, the first time it has made the level public. It reported a tripling of successful cyber operations against Norwegian businesses in the past year, said AI is making advanced attacks easier to carry out, and named companies in the supply chains of security-critical organisations among the groups most at risk.¹
The UK's National Cyber Security Centre expects AI to increase both the volume and impact of cyber attacks up to 2027, mostly by making existing techniques more effective rather than inventing new ones.²
A lot of that risk arrives outside the inbox. Verizon's 2026 Data Breach Investigations Report found that 41% of social engineering breaches involved social vectors other than email.³
Much of it also ends in someone moving money. Victims reported more than $3 billion in business email compromise losses to the FBI in 2025, second only to investment fraud, and the true figure is likely higher because many incidents go unreported.⁴ In the UK, losses to authorised push payment (APP) fraud, where the victim is tricked into sending the money themselves, rose 19% to £576.4 million. Losses to unauthorised fraud, where criminals take money without the victim's involvement, fell 5%. In UK Finance's words, criminals are "shifting from hacking systems to manipulating people."⁵
Why the old warning signs no longer help
For years, awareness training has taught employees to look for spelling mistakes, odd formatting, generic greetings and logos that don't look quite right. Those clues still help, but they are far less dependable than they were. As we covered in our look at the phishing trends outpacing SMB defences in 2026, AI-written messages, QR-code phishing and attacks through Microsoft Teams can look entirely legitimate and still be designed to trick someone into acting.
Most phishing attacks still depend on getting someone to do something: pay an invoice, approve a request, sign in, open a file or keep something confidential. The message can look completely legitimate, and it might not even be an email. It could be a Teams message or a phone call. So the more useful question isn't whether a message looks suspicious, but whether the request makes sense and has been checked before anyone acts on it.
That doesn't mean treating every message as a threat. The habit to build is checking before acting, especially when money, logins or sensitive information are involved.
Four requests employees should always verify
1. Urgent requests to pay, approve something or log in. Pressure is the point. An email that lands late on a Friday saying a supplier will be cut off today, or that your account will be locked within the hour, is designed to rush you past the point where you'd normally check. The pushier the request, the more reason to verify it another way. For a login prompt, that means going straight to the site or app rather than clicking the link.
2. A familiar sender name, but an email address that's slightly off. Most email apps show the sender's name first, and on a phone that might be all you see. A message from "Sarah Collins, Finance Director" can easily come from a lookalike domain with one letter changed, an extra word added, or a personal webmail account. A familiar name isn't enough, so check the full address. And remember a genuine address isn't proof either, because real accounts get compromised too. If the request is unexpected, verify it before acting.
3. Unexpected attachments, invoices or shared documents. Invoices and "someone shared a file with you" notifications are so routine that attackers copy them all the time. Whether it looks real is less important than whether you were expecting it. An invoice nobody asked for, a shared document from someone you rarely work with, or a file that wants you to log in before it'll open are all worth checking with the sender through a separate channel, such as a phone call or a new message, before you click.
4. Requests to change bank details or keep something confidential. These two come up again and again in payment fraud. One pattern IT teams describe goes like this: a supplier's mailbox gets compromised, the attacker quietly reads through past invoices, then sends one that looks exactly like the real thing, just with different bank details. The confidential version is a senior colleague asking for a quick, discreet payment ahead of a deal.
Either way, check using contact details you already have, never the ones in the message. And with AI making voice cloning easier, a familiar voice isn't proof on its own. Use a number you already have on file and your normal approval process.
Why one month a year isn't enough
All four requests are easy to explain and harder to recognise under pressure. Everyone knows a change to supplier bank details should be checked. Doing it at 4.30pm, with a supplier chasing and a dozen other things on, is different.
That's why an annual refresher isn't enough on its own. Employees need regular, realistic chances to check requests before they act, until it becomes a habit rather than something they have to recall from a training module.
For lean IT teams, the challenge is finding the time to make that happen. Running simulations, updating scenarios and following up on results can become a job of its own. The programme needs to run alongside everything else IT is responsible for, not create another workload.
How Pistachio helps
Practice from Pistachio helps employees build the habit of checking before they act, through realistic phishing simulations that run automatically all year. At the University of St Andrews, the simulation compromise rate dropped from 20-25% to 1-2%, and admin time went from days each quarter to minutes each month.
- Realistic requests. Simulations include payment requests, bank detail changes, shared documents and login prompts, so people get used to checking the request rather than hunting for typos.
- Email and Microsoft Teams. Employees rehearse spotting and checking risky requests in the channels they use every day.
- Scenarios that fit the role. Finance teams get invoice and payment scenarios, and everyone else gets scenarios relevant to their work, which keeps the training believable.
- Training that adapts to each person. Difficulty and frequency adjust to how each person responds, so people who struggle get more support and those who consistently report simulations aren't overloaded.
- Minimal work for IT. Practice deploys in under 10 minutes via Microsoft Entra and runs automatically, with reporting that supports evidence gathering for NIS2, ISO 27001 and Cyber Essentials audits.
Cyber Security Awareness Month is a useful reminder, but phishing doesn't stop when October does. And when a message looks legitimate, spotting typos won't help. Employees need the habit of checking before they pay, approve, open or share, and that takes regular practice, not an annual refresher.
See how Practice builds better security habits through automated phishing simulations across email and Microsoft Teams, without adding to your IT team's workload. Email contact@pistachioapp.com to book your 15-minute demo.
Sources
- Nasjonal sikkerhetsmyndighet (NSM), national cyber risk level raised to high, 27 October 2026, as reported by Dagbladet. https://www.dagbladet.no/nyheter/varsler-kraftig-okning-i-angrep/85345725
- National Cyber Security Centre, "Impact of AI on cyber threat from now to 2027", NCSC assessment. https://www.ncsc.gov.uk/report/impact-ai-cyber-threat-now-2027
- Verizon, 2026 Data Breach Investigations Report. https://www.verizon.com/business/resources/reports/dbir/
- FBI Internet Crime Complaint Center, 2025 Internet Crime Report, April 2026. https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf
- UK Finance, Annual Fraud Report 2026, June 2026. https://www.ukfinance.org.uk/system/files/2026-06/UK%20Finance%20Fraud%20Report%202026.pdf
Continue reading
Ready to reduce your human risk? Book your demo today.
“We lacked confidence that employees would recognise today’s phishing threats or respond correctly. Since using the Pistachio platform, they are more attentive and proactive in identifying potential risks. The solution is easy to manage, quick to implement, and highly effective.
“The platform is easy to implement and provides clear insights into employee phishing awareness. Its bite-sized learning encourages participation, saves administration time, and allows us to focus more on real threat detection.”
“We were looking for a practical way to improve cybersecurity awareness across the organization. Pistachio made training simple and engaging, and we’ve seen a noticeable improvement in employee awareness with minimal effort.”
“Pistachio removed the burden of planning campaigns, collecting data, and evaluating results. The program challenges each employee at their own level and provides clear, simple reporting. Pistachio has streamlined our awareness training and strengthened our organization’s cybersecurity.”
“Our goal was to help employees better recognize phishing emails and avoid malicious links. Pistachio made this easy and engaging, and we’ve seen a clear improvement in detection, fewer clicks on phishing links, and reduced data disclosure. With minimal ongoing maintenance, it’s an effective and low-effort solution.”
“Within weeks, Presence had flagged several incidents that could have otherwise been missed, including employees forwarding company data to personal accounts during offboarding. The alerts are reliable and actionable, so we've built a full investigation process around them. Although I was skeptical at first, the value was obvious almost immediately.”
“Pistachio has reduced our manual workload to zero with its automated phishing simulations and in‑box delivery of scenario‑based trainings. This has allowed our team to dedicate time to other important security initiatives while Pistachio handles our Security Awareness program seamlessly.”
“Presence automatically detects suspicious behaviour and gives us the visibility we need without constant manual oversight. Within the first few weeks we were already seeing alerts that would have otherwise gone unnoticed as the system learns what is usual and unusual behaviour for our environment.”
“Before Pistachio, security awareness was something we could only offer to a few customers. Today it’s part of every managed service we deliver, and we haven’t had to grow the team to make that happen.”
Fill out the form to book a demo:
Trusted by 1200+ customers & MSPs
