November 5, 2026 - 5 min read

By PhishClean Research Team

Can AI stop 100% of phishing? The math says no

AI is very good at this problem and it still can't finish it. The reason is partly about attackers and partly about arithmetic. If you're building a detector, the arithmetic is the part to take seriously.

Someone on r/cybersecurity once asked about building AI to stop 100% of phishing and hacking: is it possible? The replies weren't kind, but it's a good question to work through, because the answer shows where detection really is hard. It isn't where most people think.

Start with the arithmetic

Say your model is excellent. It catches 99% of phishing and wrongly flags only 1% of legitimate messages. Now run it on 10,000 emails, of which 1% are phishing:

A model that sounds 99% accurate is wrong half the time when it raises an alert. If it auto-deletes, it just destroyed 99 real emails, perhaps an invoice or a contract, in order to stop 99 phish. And it still missed one. This is the base-rate problem. Rare events are hard to flag cleanly, and every extra bit of sensitivity costs you more false alarms.

This isn't only theory. In a recent r/cybersecurity post, a co-founder of a form-building platform shared real numbers: of 34,492 forms flagged between April and October 2026, 22,286 were banned, 9,229 turned out to be legitimate, and 2,977 stayed undecided. That's about 71% precision on the decided cases, from a production system. Their conclusion was that a system that catches more isn't necessarily better if it also blocks legitimate users.

To stop 100%, you'd have to flag everything that could possibly be phishing. A filter that blocks all email has perfect recall, and it's useless.

Why some phishing can't be told apart from real mail

Better models don't solve these, because the signal isn't there to find.

• Mail from a real, hacked account. It passes SPF, DKIM and DMARC, comes from a sender you've written to for years, and may reply inside a real thread. The content alone may be perfectly normal.
• Pages on trustworthy hosts. A fake form on a popular form builder, a phishing kit on GitHub Pages or a lure in a shared document. Domain reputation says fine.
• Requests that are only wrong in context. "Please use our new bank details" could be true. Whether it is depends on a fact the model can't see.
• Things that change after the scan. A link can be harmless at delivery and hostile at the click. Kits also use cloaking, showing scanners a clean page and showing victims the trap.
• Attacks that barely touch your systems. A phone call, a help-desk pretext or a QR code on a poster passes through no filter at all.

Attackers get AI too

In a study by Heiding, Schneier and colleagues, fully AI-automated spear phishing got a 54% click-through rate, matching human experts and far ahead of 12% for generic messages. The sample was small, 101 people, and it measured clicks rather than compromises. But it undermines the clues that older models and people relied on: bad grammar and generic wording. Personalized lures are becoming cheap, and any public detector gives attackers something to test against until a lure passes.

What AI is genuinely good at

None of this means AI is a waste of time. Google says Gmail blocks 99.9% of spam, phishing and malicious messages. Machine learning handles the things humans and fixed rules can't:

• Spotting a campaign from thousands of small variations.
• Learning normal behavior, so a payment request from a first-time sender stands out.
• Reading a page visually, and noticing that it looks like Microsoft but isn't hosted by Microsoft.
• Triaging reports from users, so a small security team isn't drowning.

Reaching 99.9% and reaching 100% are completely different problems. The first is statistics at scale. The second requires knowing a stranger's intent and every private fact about a business relationship.

If you're building a detector

1. Report precision, not accuracy. On a rare class, accuracy is nearly meaningless. A model that says "not phishing" every time is 99% accurate on the example above.
2. Test on real prevalence. A balanced 50/50 dataset produces beautiful numbers that collapse in production.
3. Tie the action to the confidence. Remove at very high confidence, warn or restrict in the middle, and log at the low end. Most detection debates end up as a false choice between catching everything and blocking nothing, and this is the way out.
4. Make being wrong cheap. Give people a way to override and a way to report a mistake. Each one is also labeled data.
5. Watch your undecided pile. Cases that nobody decides are live risk with no owner. Give them a deadline.
6. Measure misses separately. Everything above only counts what you flagged. User reports on unflagged items give you a rough miss rate.
7. Publish your numbers. It keeps you honest. Ours are on our detection numbers page, including days when the sample is too thin to conclude much.

Stop aiming for zero misses

Since some phish will always land, the sensible goal is making a successful one cheap. With phishing-resistant MFA, a fooled user still doesn't lose the account. With two-person approval, a fake invoice doesn't lose the money. With a report button and fast response, one early report protects everyone else. These don't care how clever the lure was.

We're a detection company, so we have an interest in saying detection matters, and it does. PhishClean runs 27 checks on the device and warns rather than deletes, so a mistake costs a click rather than a lost message. It will still miss things, and so will every other tool that tells you otherwise.

Frequently asked questions

Can AI stop all phishing attacks?

No. AI catches a large share, but some phishing is indistinguishable from legitimate mail, such as messages from a real hacked account. Pushing detection toward 100% also creates false alarms that block legitimate messages.

Why are false positives such a problem in phishing detection?

Phishing is rare compared with normal mail. Even a model with a 1% false-alarm rate can be wrong half the time it raises an alert, when only 1% of messages are phishing. If that alert deletes or bans automatically, real users pay for it.

Do attackers use AI for phishing?

Yes. In one study, fully AI-automated spear-phishing emails got a 54% click-through rate, on par with human experts and far higher than the 12% for generic phishing, in a sample of 101 people.

What should I do instead of relying on detection alone?

Assume some phishing will get through, and limit the damage: phishing-resistant MFA, approval steps for payments, a simple way to report, and a quick response when someone does.

Sources

• Heiding, Lermen, Kao, Schneier and Vishwanath: AI-automated spear phishing study (arXiv 2412.00586)
• r/cybersecurity: One challenge of phishing detection that doesn't get enough attention (the form builder's numbers)
• CTV News (Google's 99.9% statement)
• PhishClean: Raw detection data

Last updated: 5 November 2026