Topic starter
27/06/2026 1:05 pm
TL;DR: Email attacks remain the leading cause of cybercrime losses as generative AI increases attack volume and sophistication, while unfilled cybersecurity roles widen exposure, according to Abnormal AI. The implication is that email defence now has to scale like an industrial control problem, not a human-review problem.
Editorial analysis by NHI Mgmt Group, based on content published by Abnormal AI: “An Abnormal Update: AI, Email Security, and What to Expect in 2024”.
Key questions
A: Security teams should treat AI-driven detection as a layered control, not a replacement for policy, awareness or access governance.
Q: Why do unfilled cybersecurity roles increase email attack exposure?
A: Because gaps in staffing slow tuning, triage, and response.
Practitioner guidance
- Recalibrate email risk ownership Assign email-driven identity abuse to both security operations and identity governance teams so phishing, business email compromise, and approval abuse are handled as one risk surface.
- Automate first-pass triage Use machine-assisted classification for bulk email analysis, then reserve analyst time for high-confidence fraud, credential theft, and account takeover cases.
- Measure control backlog and response latency Track how long suspicious messages, identity alerts, and recovery actions wait in queue, because staffing shortages show up first as delay.
Bottom line: Email attacks remain a leading cause of cybercrime losses because AI is increasing both the volume and believability of malicious messages.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 3 days ago by NHI Mgmt Group
27/06/2026 2:17 pm
Email has become an industrial-scale identity attack surface: The central problem is no longer whether users can recognise a suspicious message, but whether the organisation can govern inbox-driven identity abuse at machine speed. Generative AI increases both message quality and message quantity, so the old assumption that human review can absorb risk no longer holds. The implication is that email security now sits inside the identity control plane, not beside it.
A question worth separating out:
Q: What should teams do when phishing and business email compromise converge?
A: They should treat the problem as both a fraud and identity issue, with ownership shared across security operations, IAM, and incident response. That means faster mailbox investigation, tighter access correlation, and clear escalation paths for account compromise before the attacker can convert email access into downstream loss.
👉 Read our full editorial: AI-driven email attacks are widening the cybercrime loss gap
This post was modified 3 days ago by NHI Mgmt Group