TL;DR: Attune unifies identity, behavior, and content signals in one model, trained on more than 1 billion derived behavioral signals and already powering 85% of platform detections, while showing 50% higher precision than previous models, according to Abnormal AI. The broader security lesson is that static, isolated checks no longer hold up when AI lets attackers imitate trusted communication at scale.
At a glance
What this is: Abnormal AI describes a shift from isolated heuristics to behavioral email detection that evaluates identity, content and communication patterns together to catch GenAI-enabled attacks.
Why it matters: IAM and security teams should care because email compromise increasingly succeeds through legitimate-looking identity and workflow signals, which means controls must judge context and behavior, not just authentication status.
Context
Email attack detection is moving from artifact checking to behavioral modelling. When attackers can generate convincing, context-aware messages at scale, signature-style rules and isolated signal scoring stop being reliable enough to distinguish real communication from abuse.
For identity and access teams, the governance problem is that legitimacy is no longer a single control result. Authentication, sender reputation, message content and workflow history can each look valid on their own while the interaction still deviates from how the organisation normally operates.
Key questions
Q: What breaks when email security relies on isolated heuristics?
A: Isolated heuristics fail when each signal looks valid on its own but the combined interaction is abnormal. Attackers using GenAI can vary tone, destination and pretext while keeping individual artifacts plausible, so the detection problem shifts from identifying a bad indicator to recognising an out-of-pattern communication event.
Q: Why do spoofed emails still succeed when authentication controls exist?
A: Spoofed email still works when organisations treat authentication as a checkbox rather than an enforcement mechanism. Attackers also exploit compromised accounts, lookalike domains and weak user verification habits. Controls reduce risk, but only if they are enforced, monitored and paired with identity-aware process checks for approvals and account recovery.
Q: What should organisations measure to know whether behavioural detection is working?
A: They should measure whether the platform flags abnormal sequences across email, identity, and SaaS activity before the attacker completes a fraudulent action. Useful signals include token reuse across impossible combinations of device and location, unusual remote-tool usage, and payment or file activity that does not match the account’s normal behaviour.
Q: What should teams do when a trusted sender behaves out of pattern?
A: Treat the message as a trust exception and investigate the relationship, destination and request path before a user acts on it. The point is not to reject every unusual email, but to verify whether the communication still fits the sender's established behaviour.
Technical breakdown
Why isolated email heuristics fail against GenAI attacks
Isolated heuristics score one signal at a time, such as sender domain, authentication outcome or suspicious wording. That works when attacks are noisy and repetitive, but GenAI removes much of that noise by producing varied, human-like lures. The result is a detection gap: each check may pass independently while the relationship between checks reveals abuse. Behavioural detection changes the unit of analysis from single artifacts to patterns of communication, which is the only place many modern attacks become visible.
Practical implication: move detection logic from single-signal scoring to models that evaluate signal interaction across identity, content and workflow.
How unified behavioural models spot vendor email compromise
Vendor email compromise often succeeds because the message originates from a legitimate account and travels through trusted infrastructure. That means traditional authenticity checks can confirm the transport path without proving the interaction belongs in the target context. A unified behavioural model compares the message against historical tenant patterns, including how often the recipient sees mail from that sender, whether the link destination is normal, and whether the request pattern matches prior abuse. Detection comes from mismatch with baseline behaviour, not from obvious compromise markers.
Practical implication: tune controls to detect behaviour that is valid technically but abnormal for the relationship, sender and request path.
Why behavioural baselines outperform static signatures over time
Static signatures age quickly because they describe known badness, while behavioural baselines describe normality and can absorb new attack variants. In this model, the system learns how authority flows, how requests move and how relationships typically form across the organisation. That makes it harder for attackers to evade detection simply by changing phrasing or delivery mechanics. For identity governance, this is important because trust is being inferred from communication context, not from a rule that can be copied and replayed.
Practical implication: prioritise detection approaches that can adapt to new communication patterns without manual rule creation or prior variant knowledge.
Threat narrative
Attacker objective: The attacker aims to convert trusted communication into credential theft or follow-on compromise without triggering isolated email checks.
- Entry occurs through a legitimate-looking email sent from a real vendor account, which allows the message to pass authentication and infrastructure checks.
- Escalation happens when the attacker leverages trusted communication context, including a document-sharing pretext and a manual copy-paste link instruction, to push the recipient toward credential harvesting.
- Impact is achieved when the recipient treats the message as authentic because the individual artifacts appear valid even though the combined behaviour is anomalous.
Breaches seen in the wild
- SonicWall SSL VPN account compromises 2025: Attackers used valid credentials to log in to more than 100 SonicWall SSL VPN accounts across 16 environments in October 2025.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Behavioural detection is becoming the governing layer for email trust. When attackers can generate novel, context-aware messages at scale, isolated signal checks no longer describe the security problem accurately. The real issue is whether a message fits the organisation's normal communication patterns across identity, content and workflow. Practitioners should treat behavioural context as a control plane, not an enhancement.
Legitimate authentication is no longer sufficient evidence of legitimate intent. Email systems can validate a sender, a route and even infrastructure integrity while still missing a malicious interaction. That exposes a structural gap in controls that treat authenticity as a proxy for legitimacy. The practitioner takeaway is that identity assurance in email now depends on relationship history and expected request patterns.
Static heuristics are being outpaced by attacker variation, not just volume. GenAI lowers the cost of producing many distinct lures, which means signature-style detection loses reliability faster than before. The important shift is not simply more attacks, but more unique attacks that remain plausible under old rules. Organisations should expect detection quality to hinge on pattern learning rather than rule accumulation.
Identity, content and behaviour should be evaluated as one security object. Splitting them into separate checks creates blind spots at the exact moment attackers exploit their interaction. That is why behavioural models matter for modern email security: they analyse how authority, messaging style and workflow expectations combine. Security programmes should stop treating these signals as independent verdicts.
Behavioural security now sits at the intersection of IAM and messaging trust. This is not just an email problem. It is an identity governance problem because the question has become whether a communication belongs inside a known trust relationship. The implication for practitioners is that email controls, identity telemetry and workflow analysis need shared interpretation, not separate dashboards.
What this signals
Email trust now depends on behavioural context, not just authentication. Security teams should expect legitimate accounts, trusted infrastructure and realistic content to coexist in the same abuse chain. That means the control boundary has moved from message validation to relationship validation, where the real question is whether the communication belongs in the organisation's normal operating pattern.
Behavioural models create a more durable detection posture than static rules. As GenAI lowers the cost of producing unique lures, rules built around known badness will age faster. Teams should plan for detection systems that learn from how authority, frequency and request paths normally work, because those are the patterns attackers must eventually imitate.
For practitioners
- Shift detection from isolated checks to behavioural correlation Correlate sender identity, message content, link destination and historical communication patterns before deciding whether an email is credible.
- Build tenant-specific communication baselines Measure what normal looks like for each sender-recipient relationship, including frequency, authority flow and common request formats.
- Flag legitimate accounts that behave unusually Treat successful authentication as necessary but insufficient when a real account sends an uncommon request through a new destination path.
- Reduce reliance on static email signatures Use detection logic that can adapt to new lures without waiting for a known malicious pattern or manual tuning.
Key takeaways
- Email attacks are increasingly successful because they can look technically valid while still violating normal communication behaviour.
- Abnormal AI reports that Attune is trained on more than 1 billion derived behavioural signals and powers 85% of platform detections, which shows the scale of the shift toward behavioural analysis.
- Security teams should treat identity, content and workflow as one detection problem if they want to keep pace with GenAI-enabled email abuse.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | TA0006; TA0008 — Credential Access; Lateral Movement | The article centers on credential-harvesting email attacks and follow-on abuse paths. |
| Recommendation — Map these email attack patterns to credential access and lateral movement techniques in your threat detection pipeline. | ||
| NIST CSF 2.0 | DE.CM-01 — Monitoring for Security Events | Behavioural email detection is a monitoring problem focused on anomalous communications. |
| Recommendation — Use DE.CM-01 to monitor for abnormal identity, content and workflow patterns in email traffic. | ||
| CIS Controls v8 | CIS-5 — Account Management | The case depends on abused legitimate accounts and unusual trust relationships. |
| Recommendation — Apply CIS-5 to reduce the blast radius of compromised accounts and unusual sender access paths. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Record Review, Analysis, and Reporting | Behavioural analysis relies on reviewing and correlating activity signals across interactions. |
| Recommendation — Review and correlate account, message and workflow activity under AU-6 to surface abnormal trust behaviour. | ||
Key terms
- Behavioral Detection: A monitoring approach that looks for unusual activity rather than relying only on static inventories. For SaaS integrations, it detects drift in token use, data movement, timing, and endpoint behavior so teams can spot compromise, misuse, or automation that no longer matches its expected pattern.
- Vendor Email Compromise: Vendor email compromise is a form of impersonation that targets supplier, contractor, or partner relationships. Attackers exploit routine vendor communication patterns to request payment changes, invoice redirection, or other sensitive actions, so identity and process verification must extend beyond internal users.
- Behavior Baseline: A record of normal activity for a non-human identity, including typical consumers, resources, and actions over time. Baselines help security teams detect when an identity is being used in an unusual way and provide the context needed to enforce least privilege safely in dynamic environments.
- Signal Correlation: The process of joining related indicators from separate security systems so a single campaign can be understood end to end. In fraud and identity programmes, correlation turns disconnected alerts into evidence of shared attacker behaviour.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.
Published by the NHIMG editorial team on June 27, 2026.
Updated on October 8, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org