Notifications
Clear all
Topic starter
14/07/2026 4:23 pm
TL;DR: Frontier AI is making convincing phishing lures cheap, fast, and effectively unlimited, while Gartner says task-specific AI agents will be built into 40% of enterprise applications by the end of 2026, up from under 5% a year earlier. The defender's window is collapsing from hours to seconds, so pre-delivery control becomes the primary line of defence.
NHIMG editorial — based on content published by Proofpoint: Frontier AI puts machine-speed attacks in every adversary's hands
By the numbers:
- Gartner expects task-specific AI agents to be built into 40% of enterprise applications by the end of 2026, up from under 5% a year earlier.
- Microsoft now reports more than 20 million paid Microsoft 365 Copilot seats, up from 15 million in January.
Questions worth separating out
Q: How should security teams defend against AI-generated phishing at enterprise scale?
A: They should combine behavioural email detection with identity controls that react when a message becomes a compromise event.
Q: Why do AI agents create new risk in non-human identity management?
A: AI agents create risk because they operate as software identities with delegated authority, but many organisations do not track them with the same discipline applied to users or service accounts.
Q: What breaks when security teams rely on post-delivery email remediation?
A: The control breaks when the attacker can generate and deliver a lure faster than the cleanup cycle can remove it.
Practitioner guidance
- Move filtering into the delivery path Prioritise pre-delivery verdicting for high-risk mailboxes so messages are blocked before they can trigger human or agent action.
- Scope email-connected agents as delegated identities Inventory assistants and automations that can read or act on email, then define exactly which messages, actions, and data they can influence.
- Share detection signals across gateway and mailbox layers Feed post-delivery detections back into pre-delivery policy so one observed lure tightens the next verdict.
What's in the full article
Proofpoint's full article covers the operational detail this post intentionally leaves for the source:
- How Proofpoint is modelling the shift from post-delivery remediation to inline verdicting across the email lifecycle.
- The operational implications of unifying secure email gateway and API-based protection into one coordinated policy system.
- Why shared detection intelligence across layers changes investigation workflow and mailbox containment.
- How the vendor is framing pre-delivery versus post-delivery coverage for internal mailbox-to-mailbox traffic.
👉 Read Proofpoint's analysis of machine-speed email threats and pre-delivery defence →
Frontier AI email attacks: what pre-delivery controls now have to do?
Explore further
14/07/2026 4:31 pm
Machine-speed phishing is now an access-control problem, not just a content-filtering problem. The article shows that the real risk is no longer whether a lure looks convincing to a person, but whether it can trigger action before security controls intervene. That shifts the governance question toward how identity, mailbox, and session controls are enforced at the point of decision. Practitioners should treat email as a privileged ingress path into access workflows.
A question worth separating out:
Q: How should organisations govern AI assistants that can read and act on inbox messages?
A: They should define those assistants as delegated non-human identities with explicit message scope, action scope, and escalation limits. The goal is to prevent natural-language instructions from becoming unauthorised workflow triggers. Review what the agent can read, what it can do, and what requires human confirmation.
👉 Read our full editorial: Frontier AI is shrinking the time window for email compromise
