Proofpoint Says AI-Generated Emails Are Weakening Behavior-Based Detection
Summary
Proofpoint says generative AI makes phishing messages more personalized and harder to detect through behavioral signals. It advocates adding intent-based analysis and describes an agent that contained a simulated account takeover.
Key points
- At Protect 2026, Proofpoint described a campaign that sent distinct property inquiries to more than 30 real estate agents before steering conversations toward video meetings.
- One meeting invitation used a genuine google[.]com redirect with a URL parameter that sent the click to an unrelated site.
- Proofpoint described hostile messaging campaigns and device-code phishing pages disguised as court, document-signing, identity-check, and finance services.
- Proofpoint's Nexus Intent-Based Detection Model is presented as an additional layer alongside rule-, signature-, reputation-, and behavior-based detection.
- In a described RFP-themed phishing case, an attacker took over a finance user's account, hid replies with a mailbox rule, and sent about 100 messages to 42 internal recipients.
- Proofpoint said its Threat Investigation Agent contained the case four minutes after the trigger, retrieving 92 messages and removing the mailbox rule; higher-impact actions required human approval.
Article Details
- Event Type
- Proofpoint report on generative AI weakening behavior-based email threat detection, alongside its announcement of an intent-based detection model.
- Impact
- AI-generated messages can be fluent, personalized, and varied enough to evade detection based on repeated templates, sender history, or behavioral anomalies. Proofpoint argues that defenses should also assess a message’s intent and investigate campaigns across email and related systems. Examples described include phishing, business email compromise, account takeover, and disruptive communications; the article does not report a newly disclosed incident affecting Proofpoint.
Vendors
Products
Agentic Collaboration Securityannounced its Nexus Intent-Based Detection Model in September as part of what it calls the Agentic Collaboration Security system.Nexus Intent-Based Detection Modeland conversation, and what technique is being used to pursue it. The company announced its Nexus Intent-Based Detection Model in September as part of what it calls the Agentic Collaboration Security system.Threat Investigation AgentIts Threat Investigation Agent is designed to run one investigation across email, identity, messaging, browser, and supplier activity, map the blast radius, and feed findings back into detection. Use cases include