Notifications
Clear all
Topic starter
27/06/2026 1:42 pm
TL;DR: Advanced attacks bypassing secure email gateways rose 97% over six months as AI-generated threats increasingly mimic trusted communications, according to Abnormal AI, prompting leadership hires across product, customer success, and legal functions. The underlying issue is that traditional detection and governance assumptions break when identity and behaviour become harder to distinguish from legitimate business traffic.
NHIMG editorial — based on content published by Abnormal AI: Abnormal AI Expands Leadership Team to Advance Behavioral AI Platform
By the numbers:
- Over the past six months, Abnormal has seen a 97% increase in advanced attacks bypassing Secure Email Gateways.
- Abnormal is trusted by thousands of organizations, including more than 25% of the Fortune 500.
Questions worth separating out
Q: How should security teams defend against AI-generated phishing that bypasses email gateways?
A: Teams should combine behavioural detection with identity-based response, because content inspection alone is increasingly easy to evade.
Q: Why do connected applications increase the impact of email-based attacks?
A: Connected applications extend trust beyond the inbox.
Q: How can organisations tell whether behavioural AI is working in practice?
A: Look for reduced dwell time between suspicious delivery and response, better correlation between email and identity events, and fewer missed cases where legitimate-looking traffic leads to account abuse.
Practitioner guidance
- Map inbox controls to identity outcomes Review how email detections feed account lock, session revocation, and step-up verification when suspicious communication is confirmed.
- Correlate behavioural signals across connected apps Join mail telemetry with sign-in events, token usage, and app-to-app activity across Microsoft 365, Google Workspace, Slack, Workday, ServiceNow, and Zoom.
- Add auditability to behavioural decisions Require security tooling to preserve the evidence that led to a detection, including sender relationships, message timing, and abnormal interaction sequences.
What's in the full analysis
Abnormal AI's full article covers the operational detail this post intentionally leaves for the source:
- The leadership rationale behind the three executive hires and how each role maps to product, customer success, and legal governance.
- The vendor's own explanation of how its behavioural AI platform is evolving across email and connected applications.
- The full context for the reported 97% increase in advanced attacks bypassing secure email gateways.
- The company positioning around trust, transparency, and compliance for enterprise deployments.
👉 Read Abnormal AI's analysis of rising AI-generated threats and leadership changes →
AI-generated email threats: what the leadership shift means for defenders?
Explore further
27/06/2026 3:09 pm
Behavioural AI is becoming an identity control, not just an email control. When attacks are fluent enough to bypass secure email gateways, the security question moves from message filtering to trust validation across identities, sessions, and applications. That shift matters because modern abuse chains do not stop at delivery. They exploit the fact that a trusted communication channel can still carry an untrusted actor. Practitioners should treat behavioural detection as part of the identity stack, not a separate messaging layer.
A few things that frame the scale:
- The average estimated time to remediate a leaked secret is 27 days, according to The State of Secrets in AppSec.
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap, according to The State of Secrets in AppSec.
A question worth separating out:
Q: Who should own the response when AI-driven impersonation crosses from email into identity risk?
A: Ownership should sit across security operations, identity teams, and governance stakeholders, because the event is no longer only a messaging issue. If the attacker can pivot into accounts or connected apps, containment, auditability, and business impact review all become part of the same response chain. Clear accountability matters more than organisational silos.
👉 Read our full editorial: Abnormal AI leadership changes reflect rising AI-generated email threats
