Topic starter
27/06/2026 1:41 pm
TL;DR: Customers average 462 advanced attacks per month per 1,000 mailboxes bypassing Microsoft native controls, according to Abnormal AI. Its behavioral model is trained on more than 1 billion signals and now powers 85% of detections across the platform, and the governance lesson is that intent-based identity and communication profiling is now essential because signature-only controls cannot keep pace with socially engineered abuse.
Editorial analysis by NHI Mgmt Group, based on content published by Abnormal AI: “Not All AI Is Created Equal: What Makes Abnormal's Detection Engine Different”.
By the numbers:
- Customers average 462 advanced attacks per month per 1,000 mailboxes bypassing Microsoft native controls.
- 44% of employees who read a vendor email compromise message engage with it.
- Since Attune launched, unique attack detections rose by approximately 68% and it now powers 85% of detections across the platform.
Key questions
Q: What fails when email security relies on signatures instead of behaviour?
A: Signature-led email security fails when attacks look normal in context.
A: These attacks keep working because they often look like normal user activity and change faster than static indicators can be updated.
Q: How can organisations tell whether AI-based email security is working?
A: Look for reduced time to detect suspicious messages, fewer successful impersonation attempts, and faster containment after user interaction.
Practitioner guidance
- Map email detections to identity behaviour Identify whether your current mail stack evaluates sender reputation and payloads only, or whether it also models cadence, relationship history, authentication norms, and request type for each identity.
- Baseline vendor relationships separately Create distinct behavioural expectations for executive, supplier, finance, and HR communication paths so that a normal message in one workflow does not mask abuse in another.
- Test controls against clean-looking BEC scenarios Run exercises that use no malicious links or attachments, only relationship abuse and business process manipulation, because those are the cases that signature-led systems miss first.
Bottom line: Email compromise increasingly succeeds by abusing trust and routine, not by delivering obviously malicious content.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
27/06/2026 3:07 pm
Intent-based communication profiling is now a core identity control, not a nice-to-have detection enhancement. Email attacks that mirror legitimate business language defeat controls built to spot bad objects instead of bad intent. Once attackers operate inside trusted relationships, the deciding factor becomes whether the security stack can distinguish normal from abnormal behaviour at the identity level. Practitioners should treat communication profiling as part of the identity control plane, not as an email-only add-on.
A question worth separating out:
Q: What should organisations do when vendor email compromise messages are already reaching users?
A: They should treat vendor email compromise as an identity and workflow risk, not only an inbox problem. That means separating vendor relationships into their own behavioural baselines, testing clean-looking social engineering scenarios, and ensuring detection logic can evaluate intent before users act on the request.
👉 Read our full editorial: Behavioral AI exposes email attacks that bypass native Microsoft controls