The AI landscape doesn't move in one direction — it lurches. Some techniques leap from experiment to table stakes in a single quarter; others stall against regulatory walls, technical ceilings, or organisational inertia that no amount of hype can dislodge. Knowing which is which is the hard part. The State of Play cuts through the noise with a rigorously maintained index of AI techniques across every major business domain — classified by maturity, evidenced by real-world adoption, and updated daily so you always know where you stand relative to the field. Stop guessing. Start knowing.
A daily newsletter distilling the past two weeks of movement in a domain or two — delivered to your inbox while the index updates in the background.
Each dot marks the weighted maturity of practices within a domain — hover for a brief summary, click for more detail
AI that identifies phishing attempts across email, messaging, and web, including sophisticated spear-phishing campaigns. Includes NLP-based email analysis and URL reputation scoring; distinct from data loss prevention which protects outbound data rather than detecting inbound threats.
AI-powered phishing detection is a proven, widely deployed practice — but it faces a critical bifurcation in 2026 between technical capability and operational effectiveness. Detection research and vendor platforms have reached theoretical maturity: models exceed 97% accuracy in controlled settings, production deployments block billions of emails monthly, and the ecosystem spans leading vendors (Proofpoint, Barracuda, Cofense) to specialized entrants (Abnormal, IRONSCALES). Yet real-world evidence reveals persistent gaps. UK government data shows 38% of businesses report phishing attacks and 85% of breached organisations involve phishing in the attack chain. Real-world deployments reveal detection failures: large organisations consistently find 3,000+ phishing emails missed quarterly by leading platforms, while attackers have systematised response with phishing-as-a-service (90% of high-volume campaigns) and AI-assisted code generation (hybrid human-AI attacks achieving 54% click-through vs 12% human baseline). The defining tension is not technical but operational: the organisations deploying pure-detection play defenses face attackers adapting faster than filters improve, with multi-channel tactics (email, Teams, calendar, reverse proxies) overwhelming email-only controls. Practitioner surveys confirm overconfidence masking underpreparedness: 86% of attacks now use AI while only 17% of organisations deploy AI-powered defences. The practice remains on a plateau—mature capability coexisting with expanding threat surface and human-factor limitations that no detection improvement overcomes.
The attack surface has expanded decisively beyond email in May 2026. KnowBe4 and Barracuda telemetry document an unmistakable trend: while 86% of attacks now contain AI-generated content (up from 40% mid-2024), the delivery channels have fragmented. Calendar phishing surged 49%, Teams-based attacks jumped 41%, and reverse proxy credential attacks climbed 139%. Multi-channel orchestration is now standard attacker practice, overwhelming email-only defenses. On detection efficacy, large-scale vendor telemetry shows persistent gaps despite platform maturity. Microsoft Defender for Office 365 blocked 8.3 billion emails in Q1 2026, yet the same product experienced 147% surge in QR code phishing, 125% increase in CAPTCHA-gated attacks, and 175% jump in HTML-in-attachment delivery—all techniques designed to evade inspection. Abnormal AI's analysis of 800,000+ attacks across 4,600 organisations revealed that phishing tactics adapt to organisation size and workflow: small organisations face basic redirects (26.6%) while enterprises face sophisticated link shorteners (10.2%+) and file-sharing impersonation (12.4%). The tactics cluster precisely where defenses are weakest.
Real-world deployments validate vendor maturity but expose operational constraints. Shinhan Financial Group deployed real-time phishing detection across its banking group and prevented 800M won in customer losses within two weeks—concrete evidence that detection at scale works when properly tuned. Yet simultaneous evidence shows structural fragmentation limiting effectiveness: independent incident response data places phishing at only 17% of initial access (down from historical 30%+), as attackers pivot to vulnerability exploitation (38%)—a sign that email defenses have matured enough to force attacker adaptation. The phishing-as-a-service ecosystem, documented by Microsoft and Barracuda, industrialised attacks: 90% of campaigns now use PhaaS kits, with 3.4 billion AI phishing emails sent daily globally. Cofense metrics show a single piece of malicious content reaching new targets every 19 seconds. The constraint on effectiveness is now operational: only 17% of organisations deploy AI-powered defenses despite 82.6% of attacks containing AI. Practitioner readiness lags threat evolution—a fundamental tension that detection capability alone does not resolve.
— Real-world credential-harvesting campaign detected by IRONSCALES Themis AI despite multi-layer legitimate-service abuse (EdgePilot, Barracuda LinkProtect wrappers) and gateway authentication failures, demonstrating behavioral AI effectiveness in production.
— KnowBe4 Threat Lab analysis documenting 86% AI-assisted phishing prevalence, 54% vs 12% CTR effectiveness advantage, detectable LLM fingerprints, and Unicode homoglyph evasion techniques used in production attacks.
— Barracuda red team demonstrates AI-generated phishing escalating to full endpoint compromise in 5 minutes via ClickFix payload, Evilginx MFA interception, and token hijacking—negative signal showing attack sophistication and detection evasion.
— SE Labs AAA-rated independent evaluation of Cisco Secure Email Threat Defense: 98% phishing detection including 100% QR code/quishing protection, 97% nation-state malware (APT29, FIN7), zero false positives on legitimate email.
— Menlo Security 2026 report: 1 in 5 phishing attacks bypass enterprise detection at browser layer; 95.2% delivered over TLS encryption, 115K evasive campaigns detected; demonstrates detection limitations and multi-channel attack evolution beyond email-only controls.
— Microsoft publishes 4 quarters of production benchmarking (Jul 2025–Apr 2026) across 696+ customers: Defender post-delivery malicious catch improved to 96%, misses 59% fewer threats than competing SEG vendors, validates mature multi-vendor detection architecture.
— Peer-reviewed CSA research documenting March 2025 inflection point when AI-generated spear phishing surpassed expert human attacks (23% higher failure rate for AI-crafted lures), with 54% CTR vs 12% baseline and government actors weaponizing LLMs.
— IEEE Access peer-reviewed research from Tokyo Metropolitan University demonstrating infrastructure-based phishing campaign detection achieving 8-day faster discovery than experts, identifying 192K URLs with 92% malicious accuracy from 600 seed URLs.