Topic starter
27/06/2026 2:04 pm
TL;DR: Threat actors are already using generative AI, malicious GPTs, and SaaS tool abuse to exploit human trust, while organisations still relying on static rules and perimeter tools lack the architecture to respond, according to Abnormal AI. Behavior-based defense and contextual AI are now baseline requirements, not optional enhancements.
Editorial analysis by NHI Mgmt Group, based on content published by Abnormal AI: “Hard Truths, AI Beyond Hype: Key Takeaways from Innovate Summer”.
Key questions
A: They should move beyond static rule sets and inspect the whole trust path, including message behaviour, user action, and downstream SaaS permissions.
Q: Why do static email rules fail against AI-powered phishing?
A: Static rules fail because AI can vary tone, wording, timing, and structure faster than human teams can retune filters.
Q: What are the warning signs that email security controls are too static?
A: Common signs include repeated reliance on blocked domains, fixed keyword rules, and alerting that reacts only after a known pattern appears.
Practitioner guidance
- Rebuild email defenses around behavioural signals Prioritise message, sender, and interaction behaviour over static rule sets so the control can adapt when attackers vary wording, timing, and delivery path.
- Map email workflows into identity governance Review where email actions trigger SaaS access, approval, or delegation so identity and application controls are evaluated as one path.
- Reduce analyst decision load Tune investigations to remove low-confidence alerts and surface the context that explains why a message or workflow is anomalous.
Bottom line: AI-powered email threats now exploit identity and trust, not just message content, which weakens rule-based controls.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
27/06/2026 3:40 pm
Rule-based email security is being outpaced because the attacker has moved from pattern exploitation to trust exploitation. Static filters assume repeated indicators, but AI-assisted lures can vary endlessly while still looking legitimate. That shifts the real control question from 'did we see the signature' to 'did we preserve trust boundaries under changing context'. Practitioners should treat email as an identity and behaviour problem, not only a message inspection problem.
A question worth separating out:
Q: How should identity teams and email security teams share responsibility for trusted SaaS abuse?
A: They should treat email-triggered SaaS actions as a shared governance problem. Email security detects the lure, but identity governance must control the downstream permissions, approvals, and delegation paths that let a trusted interaction become an incident.
👉 Read our full editorial: AI-powered email threats are outpacing rule-based defenses