AI vs phishing: who wins? A test from the ADA campaign

Published in July 2025 as part of the ADA campaign. The platform announced at the time now operates as CysEdu.

Can artificial intelligence recognise a phishing message better than a person? In the test described below, it did: an AI-based system flagged the message as malicious within seconds and explained why. The conclusion of the ADA campaign is still the same, though: technology helps, but the final decision is made by the person who receives the message, and that depends on education.

Key points

• We tested a real phishing message with the AI-based analysis platform developed by ProDefence.
• The system classified the message as malicious and explained the manipulation techniques it used.
• Attackers use artificial intelligence too, to write more convincing messages without mistakes.
• Real protection combines automated filters with people trained to recognise warning signs.

What we tested

Have you ever received a message that “seems” real, but something does not add up? As part of the ADA: Analyze, Decide, Act campaign, we ran such a message through our AI-based analysis platform.

The result: the message was identified as malicious, with a detailed analysis in a few seconds. The system recognised the manipulation technique, showed how it played on the recipient’s emotions and gave clear explanations that an ordinary user can follow. The full test report is available below.

Why technology alone is not enough

The same technology that detects phishing is used to produce it. Language models let attackers write flawless messages, tailored to each victim and in any language. The classic warning sign, “it has spelling mistakes, so it must be fake”, no longer works.

An automated filter can stop part of the attacks, but not all of them. The message that gets through reaches a person, and that person needs to know what to check.

Warning signs that still apply

• Urgency: “your account will be blocked in 24 hours”, “final notice”.
• Emotion: fear, curiosity, greed or the wish to help.
• Unusual requests: card details, SMS codes, passwords, payments to a new account.
• Sender and link: the address does not match the organisation and the link points to a different domain.
• Channel: banks and public institutions do not ask for confidential data by email, SMS or phone.

The ADA rule is simple: analyze the message, decide only after checking through an official channel, then act (report it, delete it or alert your bank).

Education and prevention: the ADA platform

The campaign prepared the launch of a cyber education and prevention platform for children, parents, teachers, employees, managers and seniors, built on the “Analyze, Decide, Act” concept. It includes:

• real attack scenarios;
• phishing simulations and interactive tests;
• quick-response guides;
• content adapted to each type of user;
• an AI assistant that explains how to recognise, avoid and respond.

The project is carried out by ProDefence in partnership with CYSCOE, the Cyber Security Cluster of Excellence. For organisations, ProDefence also offers cyber security training and analysis of suspicious messages and files.

Frequently asked questions

Can artificial intelligence detect phishing?

Yes, AI-based systems can recognise many phishing messages and explain the techniques used, but they do not stop all of them, especially highly targeted ones.

Who wins, AI or phishing?

Neither side for good: attackers use the same technology. What makes the difference is the combination of automated filters and trained users.

What should I do with a suspicious message?

Do not click links or reply. Check through the organisation’s official channel, then report the message; if you have already entered bank details, contact your bank immediately.