Like it or lump, email refuses to date. It’s survived fax machines, BlackBerrys, Slack, Teams, WhatsApp, and many “this will replace email” startups. Email is still the backbone of business communication and that’s exactly why attackers keep coming back to it.
Despite years of investment in cybersecurity, email remains the most common way organisations get breached. And now, with AI writing better emails than most humans, the problem is getting that much harder to deal with.
Let’s look at why email is still such a weak point, how AI has impacted it, and what businesses can realistically do about it. If you’re running short on time today, you can skip ahead to the end for our handy TL ; DR summary and FAQs!
How have email threats evolved? From “LOL U WON PRIZE” to scarily convincing
Once upon a time, spotting a phishing email was easy peasy. They had:
- Terrible spelling
- Random capital letters
- Bizarrely stretched logos
- A Nigerian prince with very specific inheritance problems
You didn’t need security training to not fall for these, just functioning common sense. But fast forward to today, and phishing emails are way harder to detect.
AI-powered phishing emails:
- Are perfectly written
- Match the tone and language of real businesses
- Reference current events, real people, and real conversations
- Look exactly like something you’d expect to see in your inbox at 9:17am on a Tuesday
Why Birmingham is particularly at risk
As the UK’s second largest city, Birmingham has plenty of legal firms, accountants, financial advisers, consultants, property companies, and other professional services. These industries live in their inboxes. Client instructions, contracts, invoices, case updates, payment requests… almost all of it flows through email.
That creates a few problems:
- Staff receive hundreds of emails a day
- Messages often come from people they already trust
- Decisions are made quickly, sometimes under pressure
Attackers know this. They don’t need to blast out millions of emails anymore. One well-crafted message sent to the right person is enough. And when something goes wrong, the impact isn’t limited to IT. A compromised inbox can damage client trust, expose sensitive information, and seriously harm a firm’s reputation, especially in tight-knit local markets.
Why is email still the biggest cybersecurity weakness?
After all this time, why is email still such an easy way in? The short answer is that it’s because it relies on human trust.
Email:
- Is universally used
- Is rarely questioned when it looks familiar
- Bypasses many traditional technical controls
Firewalls don’t stop people replying and antivirus doesn’t stop someone approving a payment. And once attackers understand how your business communicates, email becomes the simplest way to exploit that. AI has only made this more effective by helping attackers make emails look much more convincing.
So, what can your business do about it?
Telling staff to “be careful with emails” isn’t really a complete strategy. Defending against modern threats means combining technical controls with realistic human safeguards.
Get your domain basics right
SPF, DKIM, and DMARC might sound dull, but they matter. Together, they help prevent attackers from spoofing your domain and sending emails that look like they came from your business. Without DMARC properly set up, it’s far too easy for criminals to impersonate you.
If you’re wondering WTF all these anacronyms mean and exactly why they’re so important, we have a full guide you can check out here.
Use smarter email protection
Traditional email filters rely heavily on known threats, but sadly AI-driven attacks don’t always reuse old tricks. Modern email security tools use behavioural analysis and pattern recognition to spot emails that don’t quite add up, even if they look clean on the surface.
It’s not perfect, but it’s a huge step up from relying on basic spam filtering alone.
Train people for today’s threats
A worrying amount of cybersecurity training is outdated. Staff are still being shown examples of phishing emails that no longer exist.
Instead, training should focus on:
- Unexpected requests involving money or data
- Urgency combined with authority
- Changes to payment details or bank information
- Emails that “feel normal” but slightly off
You don’t want to scare your staff; the goal is to make them hesitate. A pause is often enough to stop an attack from working.
Summary (TL;DR)
- Email is still the most common cyberattack method
- AI has made phishing emails far harder to spot
- Birmingham’s professional services sector is particularly exposed
- DMARC, modern email filtering, and realistic training are essential
- Cybersecurity needs to evolve as fast as the threats, or it falls behind
FAQ
Why is email still the biggest weakness?
Because it’s the easiest way for attackers to reach people directly, and people are still the weakest link.
How does AI make phishing worse?
It allows attackers to generate polished, personalised emails that blend into everyday business communication.
What does this look like in Birmingham?
An accountant or solicitor receiving a fake but convincing email from a “client” or authority figure, with no obvious signs it’s malicious.
How can SMEs protect themselves?
By locking down their domain with DMARC, upgrading email security, and training staff to question even well-written requests.
Need some extra help with your cybersecurity or any other aspect of your IT set up? Book a free, no obligation chat with Mark to talk about how we could work together!