Security professionals failed the AI-written email test two times out of three

Yubico and Okta put two messages in front of nearly 2,000 security and IT professionals and asked a simple question: which one did a person write? Only 36 percent picked correctly. More than half looked at the genuinely human message and concluded a machine had produced it.

These are people who do this for a living, surveyed across nine countries in July and published on 7 October. If their eyes cannot separate the two, the advice the rest of us have been given for two decades, watch for clumsy phrasing and bad grammar, is done. The same report found 70 percent had seen phishing increase over the past year, 44 percent said their organization suffered at least one successful AI-driven attack, and 43 percent had run into a suspicious video, voice or phone call impersonating an executive or a client.

Then the awkward part, which is what they do about their own accounts. Of this group, 87 percent know exactly what passkeys are, and 48 percent still sign in to their personal accounts with nothing but a username and password. Twenty-eight percent have no second factor on their personal email at all, which is the account that can reset every other account they own.

Take the hint from the people who should know better. You are not going to out-read a well-written fake, so stop trying and change what a successful one is worth instead. A passkey or an authenticator app on your email means a stolen password by itself opens nothing. Tendvane's privacy and accounts check goes through the sign-in settings on your PC and points out which accounts are still resting on a password alone.