Artificial intelligence hasn't replaced familiar email threats. It has collapsed the cost of running them well.
Hoxhunt found that the share of reported phishing attacks showing signs of AI assistance rose from 4% in November 2025 to 56% in December, a 14-fold increase. That surge is happening against an already enormous phishing backdrop: Microsoft reported approximately 7.6 billion email-based phishing threats in the second quarter of 2026.
The change isn't only in volume. Attackers can now generate convincing, localized messages in minutes, then rewrite them, swap sender identities, and rotate domains and URLs almost as quickly. Traditional detection that relies heavily on known templates, recycled domains, and tell-tale language errors becomes less dependable at that tempo.
The question for inbound email security is therefore an AI question: how do you recognize a campaign that is designed to look unique on every send, without tightening filters so far that legitimate mail is delayed or blocked? The challenge is no longer detection alone. It is whether the infrastructure can adapt fast enough without turning security into a source of delay or disruption.
As we explored in our earlier look at AI-powered email threats, the first effect is quality. Awkward wording, generic templates, and clumsy localization used to give users and filters something to latch onto. Those tells still appear, but they are no longer dependable. AI can produce polished messages tailored to a role, an organization, a language, and a situation.
Business email compromise shows up most clearly there. A fraudulent payment request no longer has to have a typo or an odd salutation. It can match the tone of a real colleague, vendor, or executive. Filters waiting for a known-bad domain or a recycled lure will miss it. Users trained to spot broken English will miss it too.
The second effect is variation. Once a convincing message is cheap to produce, there is little reason to send the same one twice. Attackers can keep the objective fixed (steal credentials, divert a payment, deliver malware) while changing wording, HTML, sender identity, domain, URL, and attachment from one wave to the next. That is polymorphic phishing in practice: not a new attack type, but a campaign designed so that no single fingerprint lasts.
Automation then turns quality and variation into a loop. Campaigns can be tested at scale, kept if they land, and discarded if they do not. Agentic AI can now automate more of that lifecycle, from target research and lure creation to delivery, reply handling, and follow-up, letting campaigns run faster with less direct human involvement. WitnessAI describes how these systems can adapt activity based on target responses and operate across multiple stages of a campaign. For email security teams, that means less time to write a rule against one version before the next version is already in the queue.
When grammar, tone, and layout stop being reliable indicators, detection has to move to context: sender behavior, authentication results, message structure, reputation, URLs, attachments, timing, and patterns across many messages, not the wording of any single email.
Stopping malicious mail still matters. AI makes a second failure mode more likely: the defense itself disrupts legitimate mail.
AI-generated messages are designed to resemble real business correspondence. If the only response is to widen the net, genuine invoices, customer replies, and internal requests start looking like the attack. False positives are not a side issue here. They are what happens when lookalike content is treated as if it were still easy to tell apart from real mail.
Automated campaigns also create volume. Inspection load rises, queues grow, and filtering dependencies slow down. Legitimate messages sit in the same pipeline as the attack. A detection engine that is accurate in isolation still fails if it cannot keep mail moving while it works.
And because variants appear faster than a change window, teams are pushed toward untested emergency rules. One aggressive change can solve yesterday's lure and catch today's genuine traffic.
That is why AI-driven threats demand more than a better classifier. Classification, policy, capacity, and change control have to move together, or security becomes the outage.
Resilient email security depends on five capabilities working together: classification, policy, capacity, visibility, and safe change.
Classification that is not tied to one fingerprint. Halon Classify evaluates messages across multiple threat signals rather than waiting for a static rule to match. That helps maintain effective classification even as individual characteristics such as wording, domains, and URLs change.
Policy that can act on risk, not only on a match. A convincing AI-generated BEC message may not trip a signature. It may still look wrong when combined with authentication results, sender reputation, recipient context, message characteristics, or external intelligence. Halon Protect gives teams control over whether to block, quarantine, tag, reroute, defer, or inspect further, so a lookalike does not have to be treated the same as a confirmed threat or as clean mail.
Capacity that holds when an automated wave hits. If inspection cannot keep up, legitimate mail waits. Halon’s Ultra IO is built for high-throughput processing so security checks can stay on during a surge instead of becoming the bottleneck.
Visibility that separates the campaign from the side-effect. When an AI-driven attack is mutating, teams need to see what was detected, what action was taken, and whether queues or delays are coming from the threat, a dependency, or a policy that is catching the wrong mail.
Change that can keep pace without shipping untested logic. Live Staging lets teams test new detection and policy against real traffic before enforcement. Version-controlled configuration supports review, deployment, and rollback, so a response to a new AI campaign does not have to be an all-or-nothing production change.
1. When a campaign changes its wording, domains, and URLs overnight, what still identifies it?
Can classification use multiple signals and patterns across messages, or does it wait for a new signature?
2. If an automated attack doubles inbound volume this afternoon, what happens to legitimate mail?
Do security checks stay on without growing queues, or does inspection become the delay?
3. Can you treat a high-risk lookalike differently from genuine mail that happens to look similar?
AI-generated BEC is designed to resemble real correspondence. Policy has to use context, not only content.
4. Can you see why a message was blocked, quarantined, deferred, or delivered?
During a mutating campaign, that is how teams tell a real threat from a policy side-effect.
5. Can you test and roll back a policy change before the next variant arrives?
If the only way to respond to AI-driven threats is to push untested rules into production, the architecture cannot keep up safely.
If several of those answers are "no" or "we're not sure," the gap is not only detection. It is whether the email environment can respond to AI-driven campaigns at the speed they now appear.
AI has made email threats cheaper to produce, easier to vary, and harder to recognize from a single clue. Stronger detection alone does not solve that. Organizations need classification that still works when the message changes, and infrastructure that can act on that classification without disrupting legitimate mail.
Halon Classify and Halon Protect combine threat classification with the policy control, processing resilience, and safe change needed to respond as attacks evolve.