What AI Changed

That trade-off has collapsed. AI can research a target using publicly available information — LinkedIn, company websites, social media, public records. It can draft a personalized and contextually appropriate message. It can customize it with real details. It can send it. All of this happens automatically and at near-zero cost per target.

A personalized phishing campaign that would have required 10 hours of human work per victim 10 years ago can now run at 10,000 victims per hour. Personalization and scale are no longer in tension. An attacker can have both.

This changes the threat profile fundamentally. You are no longer protected by obscurity. The fact that you don't consider yourself important or valuable doesn't mean you won't be targeted. You will be targeted by an automated system that doesn't evaluate importance — it just evaluates access.