Is AI-generated phishing really more effective?

In practice, yes. Grammar and phrasing cues that staff used to rely on are gone. Detection has to lean on technical controls and behaviour, not proofreading.

Do we need a separate AI security policy?

You need coverage of AI risk somewhere. Some organisations extend their existing acceptable use, data protection and cyber policies. Others write a standalone GenAI policy. Either is fine as long as staff know the rules.

Will AI break Cyber Essentials?

No. The controls still address the initial access routes AI-augmented attackers use. What changes is the tempo, which is a good reason to keep the basics tight.

Does Cyber Essentials require an AI policy?

Not directly. Cyber Assurance and ISO 27001 both push you towards governance that would naturally cover AI use. See our guides linked above.

AI and Ransomware: Why Cyber Hygiene Matters More in 2026

How AI changes the attacker side

Phishing quality. Well-written, contextual emails at scale, in fluent English or any target language.
Voice and video. Convincing voice clones and deepfake video used in social engineering and CEO fraud.
Reconnaissance. Faster enrichment of leaked credentials, LinkedIn profiles and public data into targeting lists.
Vulnerability triage. Quicker parsing of CVE disclosures and vendor advisories into exploit priorities.
Automation. Coding assistance that helps affiliates iterate on tooling and evasion.

None of this is science fiction, and none of it invents a new class of attack. It compresses the timeline.

What does not change

The initial access routes are still the familiar ones: exposed services, unpatched systems, stolen credentials, missing MFA and social engineering. AI makes the phishing better and the timelines shorter. It does not change what stops the intrusion.

Why cyber hygiene matters more

The window between a CVE being published and being exploited at scale is shrinking. That makes patch cadence more important.
Phishing detection based on typos, grammar and awkward phrasing is unreliable. Technical controls (MFA, conditional access, safe attachments) take on more weight.
Voice-based social engineering breaks the "call back to verify" pattern. Out-of-band verification with defined channels is now essential.
The volume of attempts is higher, so the cost of a weak account is higher.

Cyber and AI governance belong together

AI risk is not only about the tools your staff use. It is also about the tools your attackers use. Organisations that treat cyber and AI governance as separate workstreams end up with gaps at the seam. See AI governance for SMEs and a GenAI policy template for UK businesses.

Practical steps for 2026

Reduce patching windows for internet-facing systems. Aim for 48 hours on critical CVEs.
Enforce phishing-resistant MFA (WebAuthn / passkeys where possible) on admin and high-risk accounts.
Train staff on voice and video deepfake scenarios, not only email phishing.
Define out-of-band verification channels for payment changes and privileged requests.
Review shadow-sm AI use and give staff a sanctioned tool with a written policy.
Extend supplier assurance questions to cover the supplier's own AI and cyber posture.
Keep Cyber Essentials current. See renewal and MFA requirements.