Topic starter
27/06/2026 1:41 pm
TL;DR: AI now compresses target research, infrastructure build, and personalised phishing into minutes, while signature-based email security struggles against messages with no bad links, attachments, or known indicators, according to Abnormal AI. The governance problem is that controls built to detect malicious artefacts no longer match attacks that look like routine business requests and can even use real-time voice and video spoofing.
Editorial analysis by NHI Mgmt Group, based on content published by Abnormal AI: “From Spray-and-Pray to Spray-and-Play: What I Saw at Our DC Roadshow”.
By the numbers:
- One team cut phishing triage from 20 to 40 hours per week to 4 to 5 hours after deploying behavioral AI on top of an existing SEG.
Key questions
A: Security teams should use a multi-stage workflow that separates header analysis, URL and attachment scanning, screenshot review, and content classification.
Q: Why do call-back checks fail against deepfake voice and video attacks?
A: Because the verification channel itself can now be spoofed in real time.
A: A common sign is when suspicious messages are blocked but users still reach realistic-looking login pages and enter credentials.
Practitioner guidance
- Strengthen behavioural email detection Baseline normal sender behaviour, conversation timing, and relationship patterns so out-of-character requests surface even when the message is technically clean.
- Reduce reliance on call-back verification Require a second corroborating factor for urgent payment or access requests, because real-time voice and video can now be spoofed convincingly.
- Classify and escalate impersonation attempts Route suspicious business requests into fraud and identity review workflows instead of treating them only as email hygiene issues.
Bottom line: AI-generated phishing now succeeds by looking like ordinary business communication rather than by carrying obvious malware indicators.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
27/06/2026 3:08 pm
AI phishing turns email from a content-filtering problem into an identity-verification problem: the decisive issue is no longer whether a message contains a bad artefact, but whether the sender relationship and request pattern are authentic. Traditional SEG design was optimised for signatures, links, and attachments, which means it now sits one layer too low in the attack chain. Practitioners should treat conversational legitimacy as the control boundary, not message cleanliness.
A question worth separating out:
Q: What should teams do when a trusted contact requests urgent payment or access by email?
A: Treat the request as a workflow exception, not as a routine message. Require corroboration through an independent channel, check whether the request matches prior behaviour, and route anything unusual into fraud or identity review before approval is granted.
👉 Read our full editorial: AI phishing now bypasses signature-based email defenses