Generative AI is reshaping the landscape of email security, making traditional behavioral detection methods less effective. Messages that used to be easily identified due to awkward wording or templates are now sophisticated and tailored, challenging existing filters. Proofpoint, a cybersecurity company, highlighted these changes at its recent Protect 2026 conference.
Impact of AI on Email Security
At the conference, Proofpoint demonstrated how generative AI enables attackers to craft personalized messages for numerous recipients, complicating detection efforts. An example involved a threat actor contacting over 30 real estate agents using varied accounts and inquiries, all culminating in a request to join a video meeting. This deceptive approach resulted in losses, as reported by the FBI, with over 22,000 AI-related complaints in 2025 alone.
Email filters traditionally relied on detecting patterns from reused templates and infrastructure. However, AI eliminates these patterns by generating fluent, contextually appropriate, and varied messages instantly. This shift necessitates a change in analysis, focusing more on the intent behind a message rather than its immediate appearance.
The Role of AI in Deceptive Campaigns
Generative AI’s capacity to create numerous distinct inquiries has been exploited in campaigns targeting industries reliant on external communications. Proofpoint described a scenario where real estate agents received property inquiries that appeared legitimate but ultimately led to phishing attempts. The AI-generated messages were seamless, with no repeated content, leaving traditional detection methods ineffective.
These campaigns extend beyond theft, as AI also facilitates disruptive communications. Large-scale operations involve sending tailored messages to top executives, using derogatory language or AI-generated images, aiming to damage reputations without the need for malicious payloads.
Adapting Detection Strategies
Proofpoint advocates for a shift towards intent-based analysis, which examines the objectives of an email, its plausibility, and the techniques used to achieve its goals. This approach supplements traditional detection layers, maintaining their role in identifying known threats while expanding to address AI-crafted messages.
In practice, this involves using multi-tiered models that apply varying levels of analysis based on message ambiguity. This tiered approach ensures rapid processing of most emails while allowing deeper examination of suspicious ones. Proofpoint’s system, including the Nexus Intent-Based Detection Model, exemplifies this strategy.
Conclusion
The rise of generative AI demands a reevaluation of email security strategies, focusing on understanding what attackers aim to achieve rather than how they present their messages. As attackers continue to leverage AI, defenders must adapt their analysis and investigation processes to keep pace with these evolving threats. Proofpoint’s innovations in intent-based detection offer a promising path forward in this new era of cybersecurity.
