Defeating AI-Enhanced Phishing: A Practical Defence Guide for Indian Enterprise IT Leaders

• 15 October, 2026
• No Comments

In 2026, phishing is no longer the clumsy, poorly-spelled email that your helpdesk team flagged in quarterly awareness training. Threat actors now weaponise large language models (LLMs) to craft near-perfect, contextually aware lures — referencing your company’s latest press releases, mimicking your CFO’s writing style, and generating content that sails straight through legacy email security controls. For Indian enterprise IT leaders and CISOs, this shift demands a fundamental rethink of the email and identity security stack.

This guide walks through the evolving threat landscape, the technical controls that matter in 2026, and the operational posture that keeps your organisation ahead of AI-enhanced social engineering — including how to meet India’s mandatory breach-reporting timelines under CERT-In’s April 2022 directions and the Digital Personal Data Protection (DPDP) Act 2023.

What Has Changed: The AI Phishing Threat in 2026

Traditional phishing relied on volume over quality — attackers blasted millions of low-effort messages, banking on a small percentage of clicks. Defences built around signature-based filters and obvious linguistic red flags worked reasonably well in that world. That world is gone.

Today’s AI-assisted campaigns exhibit characteristics that make them fundamentally harder to detect and stop:

• Hyper-personalisation at scale: Attackers harvest data from LinkedIn profiles, company press releases, regulatory filings, and leaked databases, then use LLMs to generate individualised lures for hundreds of targets simultaneously. A finance manager receives a message referencing the exact vendor invoice she processed last week — without any manual effort from the attacker.
• Flawless language quality: Grammatical errors — once a reliable red flag — are eliminated. Native-language phishing in regional Indian languages (Hindi, Tamil, Telugu, Kannada) is now trivially achievable, removing a major barrier attackers previously faced when targeting Tier-2 and Tier-3 city offices.
• Deepfake voice and video: Voice-cloning tools can impersonate a CFO on a phone call with under one minute of publicly available training audio. Vishing (voice phishing) and “CEO fraud” attacks no longer require a fluent English speaker in the threat actor’s team — a major shift for Indian enterprises.
• Adversarial evasion: Attackers test their lures against popular email security platforms before launching campaigns, iterating until detection rates drop to near zero. By the time a signature update is pushed, the campaign has already run.
• Thread hijacking (BEC 2.0): Rather than impersonating a CEO via a lookalike domain, attackers compromise a mid-level employee’s account, wait weeks to understand communication patterns and approval workflows, then insert fraudulent payment instructions mid-thread. There is no lookalike domain to flag — the email comes from a legitimate, trusted address.

For Indian enterprises, the regulatory stakes amplify the risk. The DPDP Act 2023 and CERT-In’s April 2022 directions both impose mandatory breach-reporting timelines. A phishing-induced data breach that goes undetected for even a few days can trigger serious compliance exposure — and the reputational damage that follows a public disclosure.

Where Legacy Email Security Fails

Most organisations that suffered significant phishing-related incidents in recent years were not undefended. They had email security gateways — many of them well-known products. The failure is architectural, not just a capability gap.

Legacy Secure Email Gateways (SEGs) rely primarily on:

• URL and attachment reputation databases — effective against known-bad infrastructure, useless against newly registered phishing domains (which attackers now register hours before a campaign and discard immediately after)
• Sender policy checks (SPF, DKIM, DMARC) — bypassed when attackers use legitimate cloud-mail infrastructure (Microsoft 365, Google Workspace) to send phishing at scale, or when DMARC is set to p=none (monitoring only) rather than enforcement
• Static content filters — easily defeated by AI-generated, unique-per-message content that shares no signature with previously seen phishing
• Sandboxing of attachments — effective but slow, and attackers use time-delayed or environment-aware payloads that behave benignly during analysis windows

The result: a technically “defended” email stack that is functionally transparent to a patient, well-resourced attacker. This is the gap a modern, integrated defence architecture is built to close.

Building a Multi-Layer Defence Architecture

An effective 2026 anti-phishing posture is not a single product purchase — it is an interlocking set of controls spanning email delivery, identity, network, and endpoint layers. Here is how we structure this for enterprise clients at PJ Networks.

Layer 1 — FortiMail Advanced Email Security

FortiMail is deployed as a mail transfer agent (MTA) in front of your primary mail system — whether that is on-premise Exchange, Microsoft 365, or Google Workspace. Sitting in front of native email filtering, rather than relying on it, gives you independent detection coverage and eliminates single points of failure. Key capabilities relevant to AI-enhanced threats include:

• FortiGuard AI-based spam engine: Behaviour-based analysis rather than pure signature matching, with continuous model updates from Fortinet’s global threat intelligence network. The engine looks at sending patterns, header anomalies, and content semantics rather than fixed signatures.
• Impersonation analysis: Compares the “From” display name against your internal directory and known supplier list, flagging lookalike and display-name spoofs even when DMARC passes — critical for catching BEC attempts using legitimate sending infrastructure.
• URL rewriting with time-of-click detonation: URLs in delivered messages are rewritten to route through FortiGuard’s cloud sandbox at the moment of clicking, catching links that were clean at delivery but were switched to malicious content hours later — a technique known as delayed weaponisation.
• FortiSandbox integration: Attachments are detonated in a hardware-isolated environment with behaviour monitoring; results are fed back to the email security engine in near-real time.
• Encryption gateway: TLS enforcement for mail transport, with optional S/MIME or PGP support for high-sensitivity communications, reducing the attack surface for interception and man-in-the-middle attacks on email flows.

Correctly tuned FortiMail, integrated with FortiGuard threat intelligence, eliminates a substantial fraction of AI-generated phishing before it reaches the inbox. No email gateway catches everything — this is why defence in depth is non-negotiable.

Layer 2 — Zero Trust Network Access (ZTNA) for Identity and Application Protection

Email is the delivery vector, but credential theft is usually the objective. Once an attacker has valid credentials, perimeter-based security controls offer little resistance — the attacker looks identical to a legitimate user. Zero Trust Network Access (ZTNA) addresses this by removing the assumption of trust from any user or device, regardless of network location.

In our FortiGate-based ZTNA deployments, every application access request is validated against three factors simultaneously:

• Identity: Active Directory or Azure AD authentication with mandatory MFA — hardware tokens or authenticator apps, not SMS-based OTP which is trivially bypassed via SIM-swap attacks.
• Device posture: An endpoint agent reports OS patch level, antivirus status, disk encryption state, and the presence of required security tooling. A device that fails posture checks receives no access, regardless of credential validity.
• Context: Time of day, geographic location, and access pattern relative to the user’s established baseline. Anomalous access patterns — a login at 2 AM from a location never previously seen — trigger step-up authentication or automatic blocking with a SOC alert.

This means that even if an attacker obtains valid credentials via a phishing campaign, they cannot simply log in from an unmanaged device in an unexpected geography and reach your ERP, file server, or financial systems. The ZTNA policy denies access, and the attempted breach generates a high-priority alert in your SOC dashboard for immediate investigation.

Layer 3 — FortiGate NGFW with IPS and DNS Filtering

For phishing campaigns that make it past email security and result in a user click, FortiGate’s network controls provide a catch-net layer:

• DNS filtering: Known phishing domains are blocked at resolution — before any TCP connection is established, before any payload is delivered. DNS filtering is effective even against HTTPS phishing pages because the domain must resolve before a connection can be made.
• Web filtering with SSL inspection: FortiGate inspects encrypted HTTPS traffic, identifying malicious payloads that would otherwise be invisible to network-layer controls. This is particularly effective against credential-harvesting pages that use HTTPS to create a false sense of legitimacy.
• Botnet C2 blocking: If an endpoint is compromised via a phishing attachment, outbound command-and-control (C2) communications are blocked at the firewall, limiting dwell time and preventing data exfiltration even after initial compromise.
• Intrusion Prevention System (IPS): FortiGate’s IPS inspects traffic for exploitation attempts that may follow initial phishing-based access, providing an additional detection and blocking layer for post-compromise activity.

Layer 4 — 24/7 SOC Monitoring and Threat Hunting

Technology controls must be backed by human-led monitoring. At PJ Networks, our 24/7 SOC analysts actively hunt for phishing-related indicators across the estate, looking for patterns that automated controls may miss:

• Spikes in user password-reset requests — often the first observable indicator of a credential-stuffing wave following a successful phishing campaign
• Impossible-travel logins — the same credential used from Mumbai and Singapore within minutes of each other
• Mass email-forwarding rules newly created on mailboxes — a signature BEC technique used to siphon internal communications to attacker-controlled addresses
• Unusual outbound data transfers following a user clicking a link — indicative of successful payload delivery and data staging
• New OAuth application consents granted — attackers increasingly use phishing to trick users into granting third-party app access to their Microsoft 365 or Google Workspace accounts, achieving persistence without requiring password theft

Early detection through active hunting is how you compress the window between compromise and containment — and how you give yourself a realistic chance of meeting CERT-In’s 6-hour incident reporting requirement before the breach escalates into a notifiable event.

PrahiX Ora: The SecOps Platform Connecting All Four Layers

Visibility across email, identity, network, and endpoint layers is only actionable if the signals are correlated and acted upon at speed. Siloed tools — a standalone SIEM here, a separate NMS there, manual response runbooks in a shared drive — introduce exactly the delays that attackers exploit. This is where the unified SecOps platform we deploy and operate for clients, PrahiX Ora (built by PrahiX Tech Pvt Ltd), makes a measurable operational difference.

PrahiX Ora brings together four integrated capabilities, each directly relevant to the AI phishing defence problem:

SIEM — Correlated threat detection across your entire log estate. Ora’s SIEM ingests logs from FortiMail, FortiGate, Active Directory, endpoint agents, cloud workloads, and identity providers into a single correlation engine. Detection rules are mapped to the MITRE ATT&CK framework — including spearphishing initial access (T1566) and phishing-for-information techniques (T1598) — and fire when multi-source evidence aligns in a way that no single-source rule would catch. Graph-based attack storyline reconstruction means an analyst can see the complete chain — from phishing email receipt through credential access to lateral movement — in one view, rather than manually assembling it from disparate log sources across multiple consoles. For Indian enterprises, Ora’s tiered hot/cold/archive storage architecture is designed to support CERT-In’s direction on in-country log retention, ensuring 180 days of event history are available for incident reconstruction and regulatory evidence without requiring expensive hot storage across the entire retention window.

NMS — Unified observability so nothing goes dark during an incident. During a live phishing-driven incident, NOC visibility across firewalls, switches, wireless APs, and SD-WAN links is operationally critical. Attackers sometimes trigger network disruption deliberately, as a distraction during data exfiltration. Ora’s NMS provides single-pane-of-glass observability across multi-vendor estates — a common reality in Indian enterprises that have grown through acquisition or expanded across regional offices with heterogeneous infrastructure — using LLDP/CDP topology discovery and network path tracing. ML-based anomaly detection and auto-healing policies surface unusual traffic patterns automatically, including the kind of east-west movement that follows a successful credential compromise and internal reconnaissance phase.

Video Surveillance (VMS) — Physical and network security under one operations view. For manufacturing, retail, and multi-site enterprises, physical access events and network security events rarely exist in separate universes during a targeted attack. A sophisticated social engineering operation may combine a phishing email campaign with a physical intrusion attempt — tailgating into a server room, planting a rogue device, or briefing an insider. Ora’s video surveillance (VMS) pillar integrates ONVIF, Hikvision, and Dahua camera feeds alongside network security telemetry, giving your security operations team one unified operational picture. This is particularly relevant for Indian manufacturing and retail organisations managing tens of geographically distributed sites, where physical and cyber security have historically been siloed in separate teams with no shared tooling or alerting.

SOAR — Automated response that makes CERT-In’s 6-hour reporting window realistic. India’s CERT-In directions require reporting of cyber incidents within six hours of detection — a timeline that is operationally impossible to meet through manual processes when your team is simultaneously managing a live, multi-system compromise. Ora’s SOAR playbooks automate the first-response actions: isolating a compromised endpoint from the network, pushing updated domain and IP blocklists to FortiGate, locking a compromised Active Directory account, generating the preliminary incident record with required fields pre-populated, and notifying the designated response team with enriched context. Pre-built connectors cover the Fortinet stack natively. Automation does not replace analyst judgement — it gives your analysts the headroom to focus on investigation, triage, and strategic decision-making rather than repetitive remediation steps, which is what actually determines whether you make the 6-hour window and contain the breach before it escalates.

If your current environment relies on fragmented tooling — separate SIEM, separate NMS, manual playbooks in spreadsheets — we encourage you to assess whether Ora’s unified model is a better operational fit. Contact PJ Networks to arrange a scoped assessment.

Practical Hardening Checklist: Anti-Phishing Controls Audit

For IT leaders who want a structured starting point, here is the minimum viable hardening checklist we use in our enterprise assessments. Work through each control tier methodically before moving to the next.

Email Security Controls

• DMARC policy set to p=quarantine or p=reject for all owned sending domains — not just p=none (monitoring only)
• SPF record tightened — no wildcards, all authorised sending sources explicitly listed
• DKIM signing enabled for all outbound email flows
• FortiMail or equivalent deployed in front of Microsoft 365 / Google Workspace, not relying on native filtering as the sole layer
• URL click-time detonation enabled
• Impersonation and lookalike domain detection configured for internal VIPs and key suppliers
• Phishing simulation exercises run at least quarterly, using AI-generated lure quality

Identity and Access Controls

• MFA enforced for all users — authenticator app or hardware token, not SMS OTP
• Conditional Access / ZTNA policy active for all critical application and data access
• Privileged administrator accounts separated from daily-use email accounts
• Just-in-time access for administrative tasks where possible — no standing privilege
• OAuth app consent alerts configured to flag new third-party application authorisations
• Impossible-travel and new-device alerts active in SIEM with SOC triage workflow

Network and Endpoint Controls

• FortiGate DNS filtering enabled across all user network segments
• SSL/TLS inspection active for user outbound HTTPS traffic
• Endpoint Detection and Response (EDR) deployed on all managed devices
• Automatic endpoint isolation playbook configured in SOAR for confirmed compromise triggers
• Network segmentation reviewed — a compromised user endpoint should not have unrestricted access to servers, OT/ICS networks, or backup infrastructure

Detection and Response Readiness

• 24/7 SOC coverage in place — internal or managed (phishing-driven compromises do not observe business hours)
• CERT-In incident reporting workflow documented, tested, and supported by SOAR automation
• Log retention verified against CERT-In’s 180-day in-country direction, with evidence path documented
• Incident response plan reviewed and exercised within the past 12 months, including a phishing-to-breach scenario
• Designated CERT-In reporting contact identified and trained on the notification process

The Human Element: Awareness Training That Keeps Pace With AI

Technology controls reduce the attack surface — they do not eliminate human risk. In a world where AI can generate a convincing, contextually accurate phishing email in seconds, awareness training programmes that show employees screenshots of “typical phishing” are dangerously out of date.

Effective 2026 anti-phishing awareness training should include:

• AI-quality phishing simulations: Use a platform that generates lures at the same quality level as real attackers — so employees are trained on what they will actually face, not sanitised examples from five years ago.
• Vishing and deepfake awareness: Tabletop exercises should include voice-cloning and video-deepfake scenarios, not just email-based phishing. Finance and HR teams — the most frequent BEC targets — need specific scenario practice.
• Clear, frictionless reporting: Employees who suspect a phishing attempt must be able to report it in one click, from their inbox. Friction in the reporting process means most real incidents go unreported until damage is done.
• Positive reinforcement culture: Reward reporting; do not shame clicking. The objective is a security-aware, reporting-confident workforce — not a fearful one that hides mistakes.
• Regular updates for emerging techniques: Your awareness programme should update at least quarterly to cover the current threat landscape — including new AI-assisted techniques as they emerge.

Compliance Alignment: DPDP Act and CERT-In

Beyond the operational security case, Indian enterprises face a strengthening compliance environment that makes phishing defence a regulatory requirement, not merely best practice.

CERT-In’s April 2022 directions require organisations to report cyber security incidents — including phishing-related incidents that result in data compromise — within six hours of detection. They also require maintenance of ICT system logs for a rolling 180-day period in India, to support incident forensics. A fragmented security stack without centralised log retention and automated incident workflows is unlikely to meet either requirement reliably.

The DPDP Act 2023 establishes obligations for Data Fiduciaries around personal data protection and breach notification. Phishing-driven credential theft that leads to exfiltration of personal data will trigger notification obligations. Organisations with mature phishing defences — including the controls outlined in this guide — are better positioned to demonstrate due diligence and evidence reasonable security measures, which helps support compliance with the Act. No security product or service makes an organisation “DPDP compliant” on its own; it is the combination of technical controls, operational processes, documentation, and governance that builds a defensible compliance posture.

How PJ Networks Can Help

At PJ Networks, we have been deploying and managing Fortinet security infrastructure for Indian enterprises for over a decade. Our managed security services combine FortiMail, FortiGate NGFW, and ZTNA deployment with 24/7 NOC/SOC operations — and the PrahiX Ora platform gives our analysts the correlated visibility to detect and respond to phishing-driven compromises at the speed CERT-In requires.

Whether you are building a defence architecture from scratch, hardening an existing Fortinet estate, or looking for managed SOC coverage to extend your in-house team’s capabilities without the cost and complexity of building a 24/7 function internally, we can help.

Contact our team for a no-obligation assessment of your current anti-phishing posture and a practical roadmap to a stronger security position — including what it would take to meet CERT-In’s 6-hour reporting window from your current baseline.

AI-enhanced phishing is not a future threat — it is the threat your organisation faces today. The question is whether your defences are keeping pace with the attackers already using these tools.