Notifications
Clear all
Topic starter
27/06/2026 2:02 pm
TL;DR: Security leaders say adversaries are already using AI to attack at scale, while Abnormal AI argues that behavior-based Defensive AI can detect tone shifts, unusual logins, and workflow deviations and cut manual SOC review by more than 90%. The key change is not more rules, but stronger intent detection in place of brittle signature logic.
NHIMG editorial — based on content published by Abnormal AI: Key Insights on Defensive AI, AI-driven attacks, and the CISO guide
By the numbers:
- 98.4% of security leaders report adversaries are already using AI to attack their organizations.
- Automating analysis of user-reported messages with Defensive AI can reduce manual SOC review by more than 90%.
- 100% of surveyed security professionals ranked implementing AI in the SOC as their top business objective.
Questions worth separating out
Q: How should security teams detect AI-assisted phishing that looks legitimate?
A: Security teams should focus on behavior, not wording alone.
Q: Why do traditional email controls struggle against AI-generated fraud?
A: Traditional controls were built to catch malformed content, known bad domains, and obvious anomalies.
Q: How do you know if behavior-based detection is actually working?
A: It is working when it reduces false confidence in polished messages and surfaces compromises before the action completes.
Practitioner guidance
- Instrument communication baselines for high-risk identities Track sender cadence, thread continuity, login patterns, and workflow sequence for employee and vendor accounts that can trigger payments or access changes.
- Map business email and vendor workflows to detection points Define which approval paths, invoice intervals, and account-switching events are normal so the detection layer can alert on process drift rather than just suspicious language.
- Automate first-pass SOC review for user-reported messages Use machine scoring to cluster and prioritize reports before human review, but keep escalation thresholds tied to account privilege, payment authority, and business impact.
What's in the full article
Abnormal AI's full analysis covers the operational detail this post intentionally leaves for the source:
- Practical examples of how Defensive AI distinguishes a normal vendor thread from a compromised one.
- The specific message-analysis and workflow signals used to reduce manual SOC review.
- How the vendor applies behavioral baselines to invoice timing, phrasing, and account patterns over time.
- The CISO guide’s five operating principles for embedding AI into security operations.
👉 Read Abnormal AI's analysis of Defensive AI for email and vendor compromise detection →
Defensive AI in email security: what changes for SOC teams?
Explore further
27/06/2026 3:36 pm
Intent detection is replacing indicator detection as the relevant security primitive for AI-assisted fraud. Static rules are increasingly weak because the attacker can now generate convincing language and reuse real business context. The real control question is whether a programme can distinguish a legitimate request from a request that merely looks legitimate. Practitioners should treat behavioral anomaly as the new decision layer.
A few things that frame the scale:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to The 2026 Infrastructure Identity Survey.
- Only 44% of organisations have implemented any policies to manage their AI agents, even though 92% agree that governing AI agents is critical to enterprise security.
A question worth separating out:
Q: Who should own vendor compromise detection in an enterprise?
A: Ownership should sit across IAM, SOC, and procurement or finance, because vendor compromise is both an identity problem and a process problem. Security teams need the trust signals, while business teams know the normal approval and payment patterns. Shared ownership prevents gaps where a technically valid account still gets treated as trusted after behaviour changes.
👉 Read our full editorial: Defensive AI shifts email security from indicators to intent
