Topic starter
27/06/2026 1:53 pm
TL;DR: Missed phishing detections improved by 30% with no increase in false positives, as calendar-invite attack remediation was added and Microsoft Teams coverage extended amid attackers shifting beyond the inbox, according to Abnormal AI. The broader lesson is that human-targeted threats now move across collaboration channels faster than legacy email controls can track.
Editorial analysis by NHI Mgmt Group, based on content published by Abnormal AI: “The Top 10 Abnormal Product Releases That Advanced the Behavioral Era in 2025”.
Key questions
Q: How should security teams defend against phishing when attacks move beyond email?
A: Security teams should shift from inbox-centric prevention to browser-aware detection, stronger app-consent governance, and post-login monitoring.
Q: Why do calendar invites and chat messages bypass traditional phishing controls?
A: They bypass traditional controls because those controls were built around email-centric patterns and often assume lures arrive as messages with obvious malicious content.
Q: What are the signs that human-threat detection is not keeping up?
A: Common signs include missed detections on internal impersonation, poor coverage for Teams or calendar-based lures, and an overreliance on static indicators that generate either too many false positives or too many blind spots.
Practitioner guidance
- Extend human-threat monitoring beyond email Include Teams, calendar invites, and other collaboration surfaces in phishing detection, triage, and remediation workflows so lures are not handled as mailbox-only events.
- Test behavioural detection quality Measure whether your current controls reduce missed detections without driving false positives higher, especially for internal impersonation, compromised senders, and brand abuse.
- Add pre-send controls for accidental disclosure Use recipient-aware checks that stop misdirected email before transmission when the message contains sensitive information or the recipient context looks inconsistent with past behaviour.
Bottom line: Human-targeted attacks are no longer confined to email, and controls that stop at the inbox will miss lures delivered through collaboration tools and calendar workflows.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
27/06/2026 3:24 pm
Human-threat defence is becoming a multi-channel identity problem. Email remains important, but the control boundary now extends into collaboration systems where users act with trusted identities and attackers exploit that trust. Once calendar invites and Teams become delivery paths, the issue is no longer only message inspection. Practitioners should treat human identity risk as a cross-channel governance problem, not an email-security feature set.
A few things that frame the scale:
- Security researchers tracked consent phishing campaigns affecting 900 tenants and 3,000 user accounts in 2025.
A question worth separating out:
Q: When should organisations add pre-send checks for misdirected email?
A: Organisations should add pre-send checks when sensitive information is routinely shared by email and the risk of wrong-recipient exposure is material. Pre-send intervention matters most where accidental disclosure would create compliance, confidentiality, or reputational harm, and where post-send containment would be too late to prevent the impact.
👉 Read our full editorial: Abnormal AI's 2025 updates expand human threat coverage