Forget everything you know about AI Phishing. The rules have changed, and this is the new playbook for surviving the AI era.
Why Most Approaches Fail
Many common approaches to AI phishing are flawed at the root.
The root cause is usually one of three things:
Copying what big companies do without understanding why they do it. What works for Google doesn't work for a 10-person startup.
Over-engineering the solution when a simple approach would work better. I've seen teams spend six months building something that could have been done in two weeks.
Ignoring the human element. Technology is the easy part. Getting people to actually use it is where the real challenge lives.
The Counterintuitive Truth
In AI phishing, the best practitioners often do less, not more.
The lesson: the data tells a different story than your gut. It sounds simple. It's incredibly hard to execute.
What I Tell Founders
Before deciding anything about AI phishing, start with three questions:
What's your timeline? Because the right approach for a company with 6 months of runway is very different from one with 3 years.
What have you already tried? Most founders have tried something. Understanding what didn't work is often more valuable than knowing what might.
Who on your team owns this? If the answer is "everyone" or "no one," that's your first problem to solve.
These questions seem simple but they reveal a lot about where a company actually stands.
This connects to broader themes around zero-day AI, AI cybersecurity, AI threat detection that I've been thinking about a lot lately.
Wrapping Up
I've shared a lot here, and I know it can feel overwhelming. But you don't need to get AI phishing right on day one. You just need to get started and keep improving.
Founders who do well at AI phishing tend to share one trait: they're relentlessly practical. They don't chase perfection. They chase progress.
That's the mindset I'd encourage you to adopt. Start where you are. Use what you have. Do what you can. And keep pushing forward.
As always, I'm rooting for you.
Frequently Asked Questions
Q:What experience informs this perspective?
This perspective comes from over a decade of building companies in Silicon Valley, two successful exits (RemoteTeam to Gusto, MovieLaLa to Gfycat), and investing in 234 startups including Anthropic, OpenAI, and Scale AI. I write about what I've lived.
Q:What's the most common pushback you get on this?
People often push back by citing exceptions or edge cases. And they're usually right that exceptions exist. But building a strategy around exceptions rather than patterns is a losing game for most founders.
Q:How can I apply this thinking to my own situation?
Start by identifying the core principle behind the opinion, not the specific example. Then ask yourself: does this principle apply to my context? If yes, test it in a small, low-risk way before going all in.
Q:Do all experts agree with this view?
No, and that's fine. The best ideas in business are often contrarian. I share my perspective based on my experience and data, but I encourage you to seek out opposing viewpoints and form your own conclusions.