Generative AI is erasing the tells email filters rely on

Generative AI is making malicious emails fluent, personalised and different for every recipient — and that is stripping away the awkward wording, repeated templates and obvious behavioural patterns that email filters have relied on for years. Proofpoint says defenders now need to ask what a message is trying to make someone do, not just whether it looks unusual. ¹

The warning came as Proofpoint outlined examples from its Protect 2026 conference. In one campaign, a threat actor contacted more than 30 real-estate agents at the same company from different accounts, using different property questions and different wording before steering each conversation towards a video meeting. The messages looked like ordinary first contact, but the shared objective was malicious. ¹

The shift matters beyond email security teams. Generative AI lets attackers research targets, write convincing messages in multiple languages, imitate a person’s style and produce a fresh version for every recipient. That makes a campaign harder to catch with a template, signature or reputation check, even when the underlying goal remains the same.

What AI has changed

Older phishing campaigns often exposed themselves by cutting corners. Attackers reused text, wrote awkwardly, contacted people at strange times or relied on infrastructure with a poor reputation. Behavioural detection learned to treat those deviations as warning signs.

Generative AI reduces the effort behind each message. It can produce fluent, localised copy, match the context of an existing conversation and fabricate a plausible persona or thread. It can also vary every message quickly enough that there is no obvious template to match. The result is not that behavioural signals disappear completely, but that they become weaker when an attacker can make each interaction look normal in isolation.

Proofpoint described one property-related campaign in which the initial enquiries asked mundane questions about inspections, prices and viewing times. In one thread, an inspection enquiry sent at 2:58 a.m. became a meeting invitation 13 minutes later. The link used a legitimate Google redirect, while a parameter sent the eventual click somewhere else. Because each sender was making first contact and each message was different, the campaign had little history or repeated content for a conventional filter to compare.

The same approach could target clinics taking new patients, banks opening accounts, insurers gathering quotes or any business that regularly hears from strangers. The attack is disguised as the relationship it wants to exploit.

Why intent matters more than appearance

Proofpoint’s answer is intent-based analysis: determine what an interaction is trying to accomplish, whether that objective makes sense in context and what technique is being used to reach it. The company announced its Nexus Intent-Based Detection Model in September as part of its Agentic Collaboration Security system. ²

A bank-detail change request shows the distinction. The sender may use a genuine supplier mailbox and reply inside a real thread. The language may be polished and the domain may have a clean reputation. But the request can still be suspicious if it is the supplier’s first banking change in years, does not fit the conversation, is tied to a payment deadline, asks to move off the normal thread and tries to close down independent verification.

AI can improve the wording. It cannot make the request’s intended outcome legitimate. That is the signal defenders need to preserve.

This does not mean abandoning signatures, infrastructure reputation or behavioural baselines. Those systems remain useful for known threats and obvious deviations. Intent analysis is an additional layer for messages that pass the older checks, particularly when the sender, conversation and request all appear familiar.

Campaigns are bigger than one inbox

Proofpoint also described disruptive campaigns in which hundreds or thousands of senders contact the same executives. Some messages use derogatory language; others use generated or manipulated images. A single message may look like one angry correspondent, while the wider pattern reveals an organised attempt to overwhelm or intimidate a target.

That requires analysis across the organisation rather than scoring each email independently. Text and imagery need to be considered together, and security teams need to connect activity across users who may each see only one apparently ordinary message.

The same problem appears in device-code phishing. One phishing-as-a-service kit can present itself as a court portal, document-signing request, identity check or finance library. Each disguise changes the surface clues, but the flow still tries to persuade a victim to enter an attacker-generated code on a legitimate sign-in page.

The cost of AI-speed attacks

The FBI recorded more than 22,000 complaints involving AI in 2025, with nearly $900 million in associated losses. Its 2025 Internet Crime Report also recorded 24,768 business-email-compromise complaints and about $3.05 billion in reported losses. ³

Those figures do not prove that every incident used generative AI, but they show why faster, more convincing campaigns matter. An attacker can now create and adapt hundreds of messages while an analyst is still reviewing one. A missed email may therefore be part of a campaign that has already produced replies, sign-ins and mailbox changes.

Proofpoint says its own detection approach uses multiple tiers. A first tier evaluates all mail quickly using machine learning, threat intelligence, computer vision and language models. More ambiguous messages can receive deeper analysis, including sandboxing, topic and tone analysis and an organisational graph. The deepest tier can add multi-stage language-model analysis, voice and video signals and profiles of privileged individuals.

Its Threat Investigation Agent is designed to connect activity across email, identity, messaging, browsers and suppliers. In one example, an RFP-themed lure led to a finance account takeover, a hidden mailbox rule and roughly 100 phishing messages sent to 42 internal recipients. Proofpoint says the agent contained the incident within four minutes, while higher-consequence actions such as resetting credentials were held for human approval.

Our opinion

The useful lesson is not that AI has made email impossible to secure. It is that a security model built around clumsy writing and repeated fingerprints is being asked to solve a different problem. A fluent message can still contain an implausible request, an unusual payment change or a carefully engineered route to the attacker’s real objective.

Intent is a stronger editorial and security question than appearance: what is this person asking for, why now, and does the request fit the relationship? The challenge is making that reasoning reliable without turning every unusual business message into a false alarm. Proofpoint’s layered approach is sensible in principle because it keeps fast, established checks in place while reserving deeper analysis for ambiguous cases. The proof will be whether those systems can explain their decisions clearly enough for human teams to trust them when the cost of a mistake is high.

Generative AI has not removed the need for traditional detection. It has made it more important to combine traditional signals with context, intent and campaign-wide investigation.