AI agent identity: what changes when senders are no longer human?

TL;DR: AI-generated phishing now outperforms human-written lures, according to Valimail, with Microsoft’s 2025 Digital Defense Report showing 54% click-through rates versus 12% for human-written emails. The practical shift is from detecting bad messages to verifying sender identity, because message quality is improving faster than human detection.

Editorial analysis by NHI Mgmt Group, based on content published by Valimail: “Authenticate first, evaluate second: What DMARC teaches us about AI agent identity”.

By the numbers:

• AI-generated phishing emails pulled a 54% click-through rate, versus 12% for human-written ones.

Key questions

Q: How should security teams reduce phishing risk when AI makes scam messages more convincing?

A: Teams should stop relying on obvious spelling mistakes and train people to verify the sender, destination, and request through a separate channel.

Q: Why is content-based phishing detection less reliable now?

A: Because AI can produce fluent, context-aware messages that no longer look obviously suspicious to human readers or basic filters.

Q: What should organisations do first to prepare for AI agent senders?

A: Start with an inventory of every domain, service, and vendor that can legitimately send or act on behalf of the organisation.

Practitioner guidance

• Strengthen sender authentication enforcement Move DMARC from publish-only to reject or quarantine where possible, and treat monitoring-only states as transitional rather than acceptable end states.
• Inventory every authorised sender Create a complete register of domains, services, vendors, and future agents that send on behalf of the organisation, then reconcile it against actual mail flow.
• Bind machine actions to verified identity Require cryptographic proof and explicit scope for any system that can send messages, invoke tools, or claim organisational authority.

Bottom line: AI-generated phishing has narrowed the visual gap between legitimate and malicious messages, which makes sender identity more important than message style.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →