Proofpoint: AI-crafted email erodes behavioural detection signals
Proofpoint says generative AI is eroding the behavioural clues on which email security tools have long relied, allowing attackers to produce fluent, personalised and distinct messages at scale. At its Protect 2026 conference, the company illustrated the shift with a campaign targeting more than 30 real estate agents at one company, using different sender accounts, properties and wording before steering every conversation towards a video meeting.
The FBI’s Internet Crime Complaint Center recorded more than 22,000 complaints involving AI in 2025, with nearly $900 million in associated losses. Its 2025 Internet Crime Report also logged 24,768 business email compromise complaints and about $3.05 billion in reported losses.
Variation removes familiar email clues
Email filters historically benefited from attackers’ operational constraints. Reused templates, clumsy language, generic pretexts and recurring infrastructure created patterns that rules, reputation systems and behavioural analysis could identify. Proofpoint says generative AI reduces those constraints by producing localised prose, context-fitting replies, imitated personas and a different message for every recipient.
In the real estate example, the initial questions concerned inspections, price guides and viewings. The messages came from real mailboxes and recipients replied in active threads. In one case, an enquiry sent at 2:58 a.m. became a branded meeting invitation 13 minutes later, marked as needing immediate attention. The link used a genuine google.com redirect, while a parameter sent the click to an unrelated site.
Because the senders were making first contact and the wording changed across messages, no single history or repeated template supplied an obvious signal. Proofpoint’s point is that the common element was the desired action, not the apparent normality of any individual email.
Intent becomes an additional detection layer
Proofpoint positions its Nexus Intent-Based Detection Model as a third layer, rather than a substitute for established controls. Traditional mechanisms based on rules, signatures, infrastructure reputation and indicators of compromise can still clear known threats quickly. Behavioural baselines and threat-actor intelligence can still expose known actors and abnormal senders. Intent reasoning is intended for AI-crafted messages that can pass both checks.
The approach considers whether a request is plausible for the relationship and conversation, and which technique is being used to pursue it. Proofpoint’s bank-detail-change example involved a known supplier’s real mailbox and an authentic thread, but the request was the supplier’s first banking change in years, did not match the invoice-confirmation discussion and sought to move the exchange off-thread. It also cited a finance mailbox supposedly being mid-migration, limiting normal verification.
Tiered analysis and faster investigation
Running deep language-model analysis on every message would be too slow for normal mail flow, Proofpoint said. Its first tier evaluates all mail in under 500 milliseconds using machine learning, threat intelligence, computer vision and language models. A second tier handles fewer than 1% of messages in seconds to minutes, while a third tier examines fewer than 0.01% in minutes with multi-stage analysis, voice and video, and profiles of privileged individuals.
The company also described campaigns intended to disrupt rather than steal, in which large numbers of tailored and sometimes image-based hostile messages target executives. Such emails may contain no link or credential lure; Proofpoint says the relevant signal lies in the campaign pattern and in analysing text and imagery together.
For businesses, the practical implication is to retain established email controls while ensuring that high-consequence requests are independently verified. Payment changes, credential prompts and meeting invitations should be assessed for their requested action and fit with the underlying business relationship, not trusted merely because the wording, sender history or thread appears legitimate.