AI Email Threats:
When Attackers and Defenders Access the Same Models

Mark Overton, CISO at Softcat, opened with a grounding observation: what’s landing in security teams’ inboxes doesn’t look vastly different. The normal tells (spelling errors, for example) aren’t reliably there anymore, but the attack types themselves haven’t been reinvented. What is mainly being seen is BEC.

What has changed is the preparation phase. Kieran described how trivial it now is to scrape a LinkedIn profile, learn how a manager communicates, and send a convincing impersonation. Mark confirmed AI is being used in this reconnaissance phase, not necessarily in the email itself.

Mike Britton, CIO at Abnormal AI, added the scale dimension. Nation-states still operate at the nation-state level, but financially motivated criminals are now operating there too. Those who previously lacked the capability to run sophisticated AI email threats now do.

Phishing-as-a-service kits cost as little as $250. An attacker can now send 10,000 unique spear phishing emails to every employee in an organization – something that once demanded significant time and manual effort.

As Kieran summarized, AI hasn’t necessarily changed the attacks. It has just changed who can do them. That shift is what makes AI email threats a different problem to manage than the one companies planned for.

Andy Bates, Co-Founder of StonesThro, made the case that the baseline still matters, and that Google and Microsoft enforcing DMARC requirements for bulk senders proved it. When platforms started blocking unauthenticated email, criminals moved to AI to get around it.

Mike flagged something the room found striking: criminals are now configuring p=reject on their own sending infrastructure. Businesses sitting at p=none aren’t just unprotected. They are behind attackers who have already adopted the standard. Mike noted it still shocks him how many large organizations aren’t truly using DMARC, while criminals are.

On filtering: Mike described how phishing kits now generate unique URLs, links, and attachments per message. When every element of an attack changes with every send, there’s nothing to block.

Sean Remnant, Co-Founder of Ignition Technology, was asked where a CISO with one budget priority should put their money. His answer: Understand your attack surface and assets first. Reduce it. Do the basics.

Companies still don’t have a clear picture of what they’re exposing, and the speed at which vulnerabilities are now discovered and exploited makes that gap more dangerous than ever.

Mike walked the panel through how behavioral detection works against AI email threats. It starts with establishing what normal looks like: normal communications, normal topics, normal login geography, normal payment patterns. When something deviates, it gets flagged.

He described a supply chain compromise he experienced firsthand: attackers sat in a supplier’s inbox, watched for an invoice, then sent a follow-up redirecting payment to a different account. The email was real. The only signal was behavioral.

He also made the operational case. Over 90% of emails reported to security teams by employees are legitimate. The result is an AP team that stops processing invoices and a security team that stops prioritizing real AI email threats, both paralyzed by noise. Behavioral detection reduces that noise, letting each team focus on what it’s actually there to do.

Doug Pecarski, CEO of Simply Discover, raised the evidentiary dimension. His team works with evidentiary packs. As long as agents aren’t providing or modifying the evidence, Doug noted, they’re in a comfortable place. That isn’t what they’re finding. By the time the event occurs, the build-up is fragmented across email, Slack, Teams, and document systems. Archive retrieval and immutability are going to become critical.

The panel’s honest answer on the 12-24 month outlook for AI email threats: forecasting is unreliable when model capability is moving this fast. Mike’s point was direct: Opus came out six months ago and already feels like a watershed moment. Annual planning feels too slow. Quarterly planning is the new minimum.

Sean noted that incumbents are moving fast and have the resources to invest. But he flagged the reverse risk: AI has lowered the barrier to entry for new vendors, too, and buyers need to be more diligent about what they’re actually purchasing. Mike pushed further: using AI is not a moat. If a vendor’s only differentiator is AI, that position is fragile.

The audience Q&A brought the session back to fundamentals. An audience member asked why so many government bodies and large businesses still haven’t started DMARC. The panel’s answers: lack of education, a prioritization problem, and the perception that DMARC is complex to enable.

A lawyer in the audience, Dr. Roshni, pushed further: given the legal drivers now emerging, why aren’t more organizations acting? Andy cited five cases where companies were sued after being impersonated. Mike returned to the compliance-versus-risk-management problem: businesses optimize to pass certifications, not to actually reduce risk.

Good risk management is hard work, and most organizations struggle to get it right.

Kieran wrapped the session with a single theme: the shape of the attacks hasn’t necessarily changed. Defending against AI email threats requires the same fundamentals, executed faster.

“I certainly found five legal cases where five companies have been sued successfully due to them being impersonated.”

– Andy Bates, Co-Founder, StonesThro