I'm curious how that data was collected. Is that 48% of EU employees self reported that they could spot AI fakes, or that 48% were able to in a double-blind test? Or 48% were able to when they were in a high-stress situation where they had to make a quick decision? I suspect the answers are very different.
Similarly, 54% of employees check the sender, but what does that mean? Do they check the From: address? Do headers to make sure that the from address matched a plausible arrival path (Outlook makes this almost impossible)? Do they sit behind a policy that validates DKIM signatures and prevents messages with forged origin arriving?
When I was at Microsoft, I tried sending my work account an email from my personal mail server claiming to be from another microsoft.com address. It made it through all of the checks and wasn't flagged as external. I believe they've tightened things up since then.
David Chisnall (*Now with 50% more sarcasm!*)
npub13g…dk50d
2026-10-07 12:26:00 UTC
in reply to nevent1q…egxf
Author Public Key
npub13gcwraghdcw9xzkg3tky24feu0lzkhtlt57wpdn58y4m4tyr9qdsxdk50dPublished at
2026-10-07 12:26:00 UTCEvent JSON
{
"id": "70258140bbb2c9822e03a89955765e72193f20dd0baf839fc7dc4c756ab42545",
"pubkey": "8a30e1f5176e1c530ac88aec455539e3fe2b5d7f5d3ce0b674392bbaac83281b",
"created_at": 1791375960,
"kind": 1,
"tags": [
[
"e",
"6e7e6f0ab4f0c560869242a3d44290e62823d45e86e2bd2b4a59a2b3191f8541",
"",
"root",
"d9759f131bdf455edfd03e4cef1b4cdf37cc606f095a6cf755cd259395645125"
],
[
"proxy",
"https://infosec.exchange/@david_chisnall/117399614973199663",
"web"
],
[
"p",
"d9759f131bdf455edfd03e4cef1b4cdf37cc606f095a6cf755cd259395645125"
],
[
"proxy",
"https://infosec.exchange/users/david_chisnall/statuses/117399614973199663",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://infosec.exchange/users/david_chisnall/statuses/117399614973199663",
"pink.momostr"
],
[
"-"
]
],
"content": "I'm curious how that data was collected. Is that 48% of EU employees self reported that they could spot AI fakes, or that 48% were able to in a double-blind test? Or 48% were able to when they were in a high-stress situation where they had to make a quick decision? I suspect the answers are very different.\n\nSimilarly, 54% of employees check the sender, but what does that mean? Do they check the From: address? Do headers to make sure that the from address matched a plausible arrival path (Outlook makes this almost impossible)? Do they sit behind a policy that validates DKIM signatures and prevents messages with forged origin arriving?\n\nWhen I was at Microsoft, I tried sending my work account an email from my personal mail server claiming to be from another microsoft.com address. It made it through all of the checks and wasn't flagged as external. I believe they've tightened things up since then.",
"sig": "58c69b8ba55c373c2e7781bb87957f29947af7a7c51dd41db8d9d7fb7545ec0b51bb450ab7e099cbf6c8cef63735af23809ce38ae9a1783058776553fdcab9ff"
}