Proofpoint says AI is weakening email behaviour detection

Proofpoint said at its Protect 2026 conference that generative AI had changed the shape of malicious email. It said older behaviour-based filters had depended on clumsy wording, reused templates and other repeating patterns, and that those signals were now much less useful.

It pointed to one campaign in which a single threat actor approached more than 30 agents at the same real-estate firm from different accounts. Each message referred to a different property, but the threads all ended with the same request to join a video meeting.

The company also cited a case in which a late-night enquiry led to a branded meeting invitation and an urgent attention claim. It said the link used a legitimate redirect, while a URL parameter passed the click on to another site.

Proofpoint said AI had also been used in disruptive campaigns, in phishing kits that could be presented in several guises, and in business email compromise messages built around quoted threads and invoices. It said defenders needed to focus on the sender’s aim rather than on whether a message looked unusual.

It said it had announced its Nexus Intent-Based Detection Model in September as part of Agentic Collaboration Security, and described a three-tier review system that escalated only a small share of mail to deeper analysis. It also said its Threat Investigation Agent could work across email, identity, messaging, browsers and supplier activity, and gave an example in which it contained a finance account takeover in four minutes.