Topic starter
01/08/2026 8:53 pm
TL;DR: AI-driven, payload-less phishing and account takeover attacks can bypass secure email gateways, while AI-native cloud email security and automated incident response improve intent detection, context, and response speed, according to KnowBe4. The governing issue is not detection volume but whether identity, email, and response controls can contain trusted-account abuse before it spreads.
Editorial analysis by NHI Mgmt Group, based on content published by Knowbe4: “Closing the Gap in Email Security:How To Stop The 7 Most SinisterAI-Powered Phishing Threats”.
Key questions
A: Legacy email controls often fail because they were designed to catch bulk spam, obvious phishing markers, and slower attacker workflows.
Q: Why does account takeover make phishing harder to stop?
A: Account takeover is dangerous because the attacker sends from a valid, trusted identity.
Q: What are the signs that mailbox access is being used for phishing preparation?
A: Watch for successful device-code sign-ins followed quickly by Graph reads of inbox and sent items, especially when the session is unfamiliar or originates from a developer or build host.
Practitioner guidance
- Deploy behavioural email detection Add intent-aware analytics that score urgency, impersonation cues, unusual tone and sender behaviour, rather than relying only on links, attachments and blacklists.
- Monitor authenticated mailbox abuse Alert on inbox rule creation, external forwarding, abnormal send volume, and unusual reply chains because those often appear after credential theft or session hijack.
- Tighten account recovery and session controls Review MFA bypass paths, session persistence and re-authentication policies so a harvested password does not become durable access to email and cloud apps.
Bottom line: AI-powered phishing is succeeding because it exploits trust, context and authenticated identities rather than relying on obvious malicious payloads.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
01/08/2026 9:02 pm
AI-powered phishing has shifted email defence from message inspection to identity governance. Once an attacker can impersonate a trusted sender or operate from a compromised mailbox, the email gateway is no longer the decisive control. The relevant question becomes whether the organisation can detect abuse of a valid identity before that identity is used to spread compromise. Practitioners should therefore treat email as an identity-bearing channel, not just a content-filtering problem.
A few things that frame the scale:
- Roughly 1 in 3 phishing payloads are delivered outside email, through channels such as social media, search ads and messaging apps.
A question worth separating out:
Q: Should email security and IAM teams handle phishing as one control problem?
A: Yes. Modern phishing often crosses inbox, consent, and mailbox controls in a single flow, so separate teams can miss the full attack path. A useful operating model is to join message authentication, identity consent review, and post-authentication monitoring so that a trusted-looking email cannot independently grant durable access.
👉 Read our full editorial: AI-powered phishing is outpacing legacy email security controls