Behavioral AI exposes email attacks that bypass native Microsoft controls

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Abnormal AI's blog post: Behavioral AI catches email attacks that native Microsoft controls miss, with the central finding that advanced, text-based attacks routinely bypass signature-led defences.

Why it matters: It matters because email compromise still starts with identity and relationship abuse, so IAM and security teams need controls that evaluate sender behaviour, not just authentication or content indicators.

By the numbers:

• Customers average 462 advanced attacks per month per 1,000 mailboxes bypassing Microsoft native controls.
• 44% of employees who read a vendor email compromise message engage with it.
• Since Attune launched, unique attack detections rose by approximately 68% and it now powers 85% of detections across the platform.

Context

Email security is not only a content-filtering problem. Text-based attacks succeed when they look normal for the relationship, the sender, and the moment, which is why native controls that rely heavily on signatures, reputation, or obvious malicious indicators can miss them.

For identity and access teams, the important shift is that the attack surface now includes behavioural context around users, vendors, and authentication patterns. The practical question is whether the control plane understands intent well enough to separate legitimate business communication from socially engineered abuse.

Abnormal AI's analysis frames this as an AI detection problem, but the underlying governance issue is broader: organisations need to treat communication behaviour as an identity signal, especially where email remains a privileged business workflow.

Key questions

Q: What fails when email security relies on signatures instead of behaviour?

A: Signature-led email security fails when attacks look normal in context. A clean thread, a compromised mailbox, or a lookalike domain can bypass controls that only inspect indicators, while behavioural profiling can still spot requests that do not fit the identity's normal communication pattern.

Q: Why do socially engineered email attacks and account takeovers keep bypassing traditional email security controls?

A: These attacks keep working because they often look like normal user activity and change faster than static indicators can be updated. Traditional controls that depend on known bad signatures or isolated signals miss the contextual pattern of identity abuse. Behavioral correlation across email, identity, and endpoint data gives defenders a better chance to detect compromise before access is expanded or reused.

Q: How can organisations tell whether AI-based email security is working?

A: Look for reduced time to detect suspicious messages, fewer successful impersonation attempts, and faster containment after user interaction. A useful system should also explain why it flagged a message, so analysts can tune rules and validate model output. If it only lowers inbox noise, it may not be reducing actual identity risk.

Q: What should organisations do when vendor email compromise messages are already reaching users?

A: They should treat vendor email compromise as an identity and workflow risk, not only an inbox problem. That means separating vendor relationships into their own behavioural baselines, testing clean-looking social engineering scenarios, and ensuring detection logic can evaluate intent before users act on the request.

Technical breakdown

Why signature-based email controls miss advanced attacks

Signature-based email security works by matching known indicators such as malicious domains, suspicious attachments, or payload patterns. That approach fails when an attacker uses a clean-looking thread, a lookalike domain, or an authenticated mailbox to issue a request that appears normal in isolation. The article's key point is that many high-value attacks are text-first and relationship-aware, so the relevant signal is not the message artefact alone but whether the request fits established communication behaviour. Behavioural AI changes the detection unit from content to context.

Practical implication: review where your email controls still depend on indicators of compromise rather than relationship and behaviour analysis.

How identity-aware behavioural models separate normal from malicious mail

The article describes a model that builds individual profiles for people and vendor relationships instead of relying on organisation-wide baselines. That matters because the same request can be benign for one identity and suspicious for another. When the system evaluates authentication history, cadence, request type, and communication pattern together, it can identify intent without needing a prior malicious example. In governance terms, this is a shift from static rule enforcement to identity-specific anomaly interpretation.

Practical implication: map which identities, suppliers, and workflows need per-relationship baselines rather than shared tenant-wide thresholds.

Why automation depends on precision in email detection

Automation in email defence only works when false positives stay low enough for teams to trust the system. The article ties precision to operational outcomes, noting that users can spend very little time in the platform while detections continue to rise. That combination is important because many email tools create enough noise that analysts must still triage most alerts manually. Behavioural AI becomes operationally useful when it can preserve coverage and precision at the same time.

Practical implication: evaluate whether your email security stack can sustain automated response without creating a second manual review burden.

Threat narrative

Attacker objective: The attacker wants to exploit trusted email channels to divert payments, steal credentials, or extend account compromise without triggering signature-based defences.

1. Entry occurs through a socially engineered email that looks legitimate in the context of an existing relationship, such as a vendor thread or a compromised executive mailbox.
2. Credentialed or trusted communication is then abused because the message clears conventional authentication or reputation checks even though the request diverges from normal behaviour.
3. The attacker escalates by using the trusted channel to obtain sensitive information, redirect payment activity, or widen compromise across additional recipients.
4. Impact follows when the recipient acts on the request or forwards it internally, turning a single deceptive message into business disruption or account abuse.

Breaches seen in the wild

• Twilio 0ktapus breach 2022: SMS phishing of employees exposed 209 Twilio customers and 1,900 Signal users, part of the 0ktapus campaign against 130+ firms.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Intent-based communication profiling is now a core identity control, not a nice-to-have detection enhancement. Email attacks that mirror legitimate business language defeat controls built to spot bad objects instead of bad intent. Once attackers operate inside trusted relationships, the deciding factor becomes whether the security stack can distinguish normal from abnormal behaviour at the identity level. Practitioners should treat communication profiling as part of the identity control plane, not as an email-only add-on.

Behavioural AI exposes a blind spot in conventional Microsoft-era defence assumptions. Native mail controls are still optimised for observable malicious artefacts, while modern attacks increasingly exploit trust, routine, and human response patterns. That gap is not just technical, it is a governance failure around what counts as a high-risk identity signal. The implication is that email defence must be measured against relationship fidelity, not just message hygiene.

Identity and communication behaviour form the new blast radius for business email compromise. A compromised or spoofed mailbox is dangerous because it inherits trust, context, and habitual response patterns that bypass static controls. This is why the most useful concept here is behavioural trust drift: the gradual mismatch between what an identity normally does and what an attacker needs it to do. Practitioners should assume that the blast radius starts before content inspection and ends only when intent is evaluated.

Per-identity baselines are more defensible than tenant-wide normality models for high-risk mail workflows. The article's strongest governance lesson is that a single organisational baseline cannot represent the diversity of vendor relationships, executive communication styles, or approval chains. Security teams that centralise too aggressively lose the nuance needed to detect abuse in context. The practical conclusion is that detection fidelity improves when governance is anchored to identity-specific behaviour, not aggregate averages.

Automation in email security only scales when precision is high enough to preserve operator trust. The operational value of behavioural detection is not just better detection rates, but fewer false positives and less analyst churn. That changes how teams can structure response, because automation that is noisy is not automation at all. Practitioners should judge email security by whether it reduces manual triage without missing the attacks that matter most.

What this signals

Behavioural trust drift: the decisive risk is no longer obvious malware, but the slow mismatch between an identity's normal communication pattern and the request an attacker needs it to make. Security teams should expect email controls to move closer to identity analytics, because relationship context is now part of the attack surface.

For practitioners, the useful question is whether email defence can distinguish business-as-usual from abuse inside trusted channels. If the answer depends on signatures, reputation, or payload scanning alone, then the programme still assumes attacks look like attacks before they succeed.

For practitioners

• Map email detections to identity behaviour Identify whether your current mail stack evaluates sender reputation and payloads only, or whether it also models cadence, relationship history, authentication norms, and request type for each identity.
• Baseline vendor relationships separately Create distinct behavioural expectations for executive, supplier, finance, and HR communication paths so that a normal message in one workflow does not mask abuse in another.
• Test controls against clean-looking BEC scenarios Run exercises that use no malicious links or attachments, only relationship abuse and business process manipulation, because those are the cases that signature-led systems miss first.
• Review automation thresholds for false positive tolerance Measure whether analysts can trust auto-remediation and queue suppression without spending significant time rechecking alerts, since high-noise systems will not sustain behavioural detection at scale.

Key takeaways

• Email compromise increasingly succeeds by abusing trust and routine, not by delivering obviously malicious content.
• The strongest evidence in the article is operational, with 462 advanced attacks per month per 1,000 mailboxes bypassing native controls and 44% of employees engaging with vendor compromise messages.
• Practitioners should shift from message-centric filtering to identity-aware behavioural detection that can evaluate intent in context.

Key terms

• Behavioural email detection: A detection approach that looks for patterns in sender behaviour, message timing, language change, and downstream user interaction rather than relying only on signatures. It is designed to catch attacks that mutate quickly. For identity programmes, its value is in finding the moment an email becomes an access risk.
• Vendor Email Compromise: Vendor email compromise is a form of impersonation that targets supplier, contractor, or partner relationships. Attackers exploit routine vendor communication patterns to request payment changes, invoice redirection, or other sensitive actions, so identity and process verification must extend beyond internal users.
• Identity-Specific Baseline: A normal-behaviour profile built for one person, vendor, or workflow instead of for the whole organisation. It is more precise than a tenant-wide average because the same request, tone, or timing can be expected for one identity and suspicious for another.
• Behavioural Drift: Behavioural drift is the gradual change in what an identity does compared with what it was originally approved to do. For AI agents, drift can come from prompt changes, model updates, expanded integrations, or altered workflows, which makes access review alone an incomplete control.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.