Notifications
Clear all
Topic starter
01/07/2026 2:03 am
TL;DR: AI-generated phishing can rewrite sender infrastructure, phrasing, and payloads for every target, making signature-based rules increasingly fragile, according to Abnormal AI. The practical shift is from cataloguing known-bad indicators to detecting deviations from identity-specific behavioural baselines that attackers have to imitate in real time.
NHIMG editorial — based on content published by Abnormal AI: the case for behavioural detection over signature-based phishing rules
Questions worth separating out
Q: How should security teams detect phishing that changes every time it appears?
A: Security teams should move from static signature matching to identity-aware behavioural detection.
Q: Why do AI-generated phishing attacks defeat known-bad rules so easily?
A: They defeat known-bad rules because the attack no longer needs to reuse the same domain, wording, or payload.
Q: What do security teams get wrong about phishing detection at scale?
A: They often overvalue exact-match detection and undervalue contextual trust signals.
Practitioner guidance
- Shift primary phishing detection toward behavioural baselines Measure whether each identity's email, login, and request patterns stay within expected bounds, then alert on meaningful deviations instead of relying on reusable indicators.
- Fuse identity, email, and workflow telemetry Correlate weak anomalies across communication patterns, access context, and timing so that a plausible single event becomes a detectable pattern when combined with others.
- Re-tune controls for high-variation phishing Keep signature rules for commodity reuse, but pair them with identity-aware detections that can catch new phrasing, new infrastructure, and per-target variation.
What's in the full article
Abnormal AI's full analysis covers the operational detail this post intentionally leaves for the source:
- How the vendor models identity-specific behavioural baselines across writing style, contact patterns, and system touchpoints
- Examples of how fused signals improve detection when no single indicator is strong enough on its own
- The product and engineering view of why a stable definition of normal is more resilient than cataloguing known-bad artifacts
- Implementation detail on how scoring combines email, login, and request context in practice
👉 Read Abnormal AI's analysis of AI-generated phishing detection and behavioural baselines →
AI-generated phishing: why signature rules keep missing it?
Explore further
01/07/2026 2:23 am
Signature catalogues are losing the race against model-generated phishing. The core assumption behind known-bad detection is that adversaries reuse enough of the same artefacts to be fingerprinted. AI-generated phishing breaks that premise by creating fresh sender details, wording, and lure structure for each target. The implication is that defenders must stop treating history as a sufficient model of future malicious behaviour.
A few things that frame the scale:
- 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to The 2026 Infrastructure Identity Survey.
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security.
A question worth separating out:
Q: How can organisations reduce false trust in email-driven identity attacks?
A: Organisations should combine behavioural baselining with stronger verification for unusual requests, especially when a message breaks an established relationship pattern. That reduces false trust without depending on the attacker to leave a reusable signature. Linking email behaviour to identity context improves both detection and response.
👉 Read our full editorial: Signature-based detection fails when AI-generated phishing mutates
