The Role of AI in Email Security

Executive Summary

Email is one of the most common ingress points into organizations for threat actors. As organizations have implemented email security solutions and trained employees to recognize email attacks, threat actors have pivoted to more advanced methods that bypass protections. They have also embraced artificial intelligence (AI) to make attacks more scalable and personalized while also less detectable.

Email security vendors are using AI in their defensive tools to stop attacks that leverage new and emerging attack methods in email. Many organizations have gained AI-enabled protections by virtue of their incumbent email security vendors adding AI capabilities to strengthen defensive posture. In addition, most have gone shopping for new solutions offering AI to bolster the baseline protections offered by cloud email providers.

When purchasing AI-enabled solutions to strengthen email security, organizations want the ability to protect more than just email, automated mitigation and remediation of identified threats, and next-generation capabilities to safeguard employees, the organization, and its customers, suppliers, and business partners. 

KEY TAKEAWAYS 

• Cybercriminals are already using AI in email attacks
  Threat actors are making higher use of emerging attack methods—many enabled by AI technologies—that circumvent traditional email security defenses and reach the inboxes of their targeted victims. Organizations expect cybercriminals to continue to innovate in how AI is used in email attacks.

• Organizations are strengthening defenses with new AI-enabled tools
  With the changing threat environment in email, organizations are implementing new defenses. Nine out of ten organizations have implemented an AI-enabled email security solution beyond what is offered by their cloud email provider.

• AI capabilities are safeguarding and improving detection efficacy
  Four out of five organizations indicate that AI-enabled email security solutions have enabled them to safeguard or improve the efficacy of detecting multiple types of threats in email, even as threat actors have changed their attack methods.

• Organizations want to protect more than just email via AI
  Buyers of AI-enabled email security solutions want the ability to protect email as well as the other communication and collaboration applications used across the organization, such as Microsoft Teams, SharePoint, OneDrive, Zoom, Slack, and Salesforce. From the buyer’s perspective, AI has a role in defending against threats in more than just email.

• AI-enabled threat detection complemented with human intelligence and feedback
  Along with AI, organizations are increasingly looking to human intelligence, feedback, and insight as a necessary component in email security. While AI is finally starting to transform threat detection, educated/empowered humans on the front line are invaluable. Honed human intuition is powerful. Organizations recognize this, evidenced by their top buying factors. 

Why AI for Email Security? 

Email is a key attack vector for threat actors who seek confidential information, account credentials, and financial gain from their victims. In response, organizations have adopted email security solutions to analyze inbound, internal, and outbound email traffic to identify malicious messages to stop attacks before they become costly incidents. Threat actors are continually modifying their attack patterns to improve the efficacy of their crimes, and organizations their defensive posture to stay one step ahead.  

Traditionally, email security solutions have relied on detection methods such as signatures (“we’ve seen this message before”), rules (“don’t allow messages with EXE attachments”), blacklists/blocklists (“always block all messages from this domain”) and whitelists/allow lists (“email from these domains is always good.”) These methods continue to detect and block many attacks.

The capabilities of these traditional methods have been exceeded, however, by cybercriminals adding new attack methods to long-running attack types. These new and emerging attack methods have created forms of spear phishing, business email compromise, executive impersonation, and other types of attacks that rely on malicious intent (not links or attachments), the compromise of high-reputation email accounts, impersonation, and social engineering. Traditional email security defenses struggle to detect the presence of these malicious signals and markers; without the use of new AI-enabled detection methods, they assume all is well. 

HOW CYBERCRIMINALS USE AI IN EMAIL ATTACKS

Threat actors are making higher use of attack methods that circumvent traditional email security defenses to reach the inboxes of their targeted victims. Threat actors are keen to continue stealing account credentials, redirecting payroll and invoice payments to bank accounts under their control, and gaining access to data that can be weaponized for extortion. This is an enduring dynamic, and at times, a Sisyphean challenge for organizations.  

Cybercriminals are using AI in email attacks in multiple ways, for example:  

• To create unique attacks at scale
  Polymorphic techniques morph multiple aspects of an email message—e.g., the subject line, sender, wording, sending infrastructure—to create unique attacks that bypass signature-based detection methods. AI technologies offer threat actors the perfect bar for mixing malicious cocktails that are targeted, unique, and generated at scale—think spear phishing and business email compromise attacks on steroids.

• To mimic the writing style, tone, and mannerisms of the supposed sender
  AI services can be used to analyze the stylistic and grammatical nuances of any given person, creating near-perfect matches that the person didn’t write—but could have. Think high-efficacy executive impersonation, email thread hijacking for pretexting, business email compromise attacks, and more.

• To improve baseline message grammar quality
  The presence of spelling mistakes and bad grammar has tipped off many intended victims that an email message is malicious. However, the recent emergence of generative AI services, such as ChatGPT and malicious equivalents such as WormGPT, has enabled threat actors to increase the quality of their writing and decrease the easy giveaways of malicious intent.

Any ethical concerns about AI’s use by governments and organizations are not shared by cybercriminals. What cybercriminals do is fundamentally unethical, and AI is but another tool to increase the scale, cadence, and efficacy of cyberattacks. 

HOW VENDORS USE AI IN EMAIL SECURITY

Given the changing threat landscape in recent years, established vendors have augmented their solutions with AI capabilities while emerging email security vendors have entered the market with solutions designed around AI and machine learning (ML). As security leaders demand modern security tools to prevent modern attacks, the changing threat landscape demands the use of AI by any vendor wanting to be relevant to current and potential customers.  

Vendors are using AI to improve email security capabilities and processes, such as:  

• To understand the behavior and profile of each sender and recipient
  An AI model is created to profile the sending and receiving pattern of each person in the organization. For individuals: who sends messages to them? What are the messages about? When are these messages sent and from where? Is anyone else normally copied, or is the email sent to a single recipient? What email address or addresses are used by each sender? In other words, AI is used to create a picture of what is normal for each person.

• To detect anomalous sending patterns
  A combined analysis of baseline sending patterns (created and maintained using social graphing techniques); derivative and near-match email addresses; messages that contain social engineering triggers; the presence of impersonated logos and other visual brand elements; and the classification of tone, emotion, and style in an email message can be used to detect anomalous email messages that are obfuscated to human sense-making processes. Although employees have been trained through security awareness programs to look for messages bearing these out-of-place signals, AI brings together these disparate analysis strands at the speed of cyber, the only way to ensure consistent and reliable application in the face of growing message volumes.

• To identify content written by generative AI tools, especially malicious content
  With threat actors using generative AI tools to create sophisticated and convincing email threats, email security vendors are adding AI models capable of detecting such usage. These models decode the semantic context of the email to identify recurring patterns in generated messages, and especially malicious context and intent.

• To create derivative training data for ML models
  AI-based solutions detect messages carrying malicious intent by reference to multiple ML models, which are developed, refined, and updated using training data composed of, for example, messages that have been classified as malicious or benign. Some vendors use generative AI services to create additional message samples off a known malicious message, which expands the known-good training data available to the ML model.

• To strengthen incident response and remediation processes
  AI acts as a force multiplier for understaffed and under-resourced incident response and security operations teams by providing improved accuracy, scalability, prioritization, and real-time mitigation of email threats.  

Best Practices in Using AI for Email Security

While email security is a mature market with a long history, new and emerging threat methods along with AI-enabled protections are shaking things up. This new curve means it is still early days for AI-enabled protections, and what’s currently available is not fully baked. Better than what existed before? Definitely. Perfect? Not yet. The organizations in this research are already using AI to strengthen email security. Others who are lagging in adoption and usage should get moving.

Best practices for using AI for email security are:  

• If you can’t see new threat methods in email, fix visibility
  It is a problem when organizations can’t see the email-borne threats and emerging threat methods directed their way. When less than a complete picture of threats is available to security decision-makers, they will be caught unaware as new attack methods get through to employees. Fix the question of visibility, and act accordingly. One approach is to set up an evaluation of a solution from an email security vendor offering protections against new and emerging threat methods. This assesses the current efficacy of your email security and the scale and import of unaddressed threats. All organizations should do this assessment once, and most should find a way to regularly assess which email threats are still getting through.

• Technology plus process plus people is still the order of the day
  Employees continue to have an essential role in email security. The presence of new AI-enabled protections doesn’t set up a win-lose dynamic between the best security technology on offer and people who are informed, trained, and engaged in ensuring email messages are not malicious. It’s both/and, not either/or. The organization wins when technology, people, and processes work in harmony to detect, mitigate, respond to, and address threats in email. If an employee sees something out of place that the AI has not detected, reporting the message mitigates the current threat and adds a training data point for the detection model. 

• Take signals for detecting attacks in email from more than just email
  Attacks that start in email don’t always finish there. For example, a spear phishing email written using generative AI requires the victim to do something that appears normal, such as opening an attachment that contains malicious code, starting a process to change a bank account number, or replying with sensitive information. Each of these subsequent processes generate associated signals that can be analyzed for behavioral anomalies. Organizations need the ability to capture and aggregate threat signals from more than just email, creating a holistic picture for end-to-end threat detection across their infrastructure.

• AI does not eliminate the need for cybersecurity expertise
  There is a synergistic relationship between AI and cybersecurity professionals. AI is orders of magnitude better, cheaper, and faster at detecting anomalies and creating behavioral profiles than cybersecurity professionals. Cybersecurity professionals, on the other hand, are often better at understanding the intricate human patterns that characterize malicious activities. Leveraging both machine efficiency and human insight recognizes that while AI can process vast amounts of data and detect patterns beyond human capabilities, the human element is essential for interpreting those patterns and making nuanced judgments to help finetune the AI models. Combining human insight and AI-driven analysis in incident response processes or managed services ensures a more robust defense and a faster response to email-borne threats. 

• More doesn’t necessarily mean safer, but one may not be enough
  Cloud-based email services from major providers already include AI-enabled email security protections, but many organizations find these baseline protections insufficient because threats using new and emerging methods continue to reach employees. To increase overall detection efficacy by extending baseline capabilities, most organizations add complementary solutions from specialized email security vendors. Using multiple vendors allows a layered approach to email security that offers synergistic benefits— assuming the right orchestration and vendor mix—allowing security teams to get a better picture of the threats facing their organization. However, it is possible to have too many vendors, where functionality overlaps to the point of confusion and efficacy isn’t enhanced. In the final analysis, counting the number of vendors an organization is using for email security is virtually meaningless. The right answer for a given organization can be a low number or high one, but the proper analysis question is whether the email-borne attacks and threat methods the organization is subjected to are being neutralized as quickly and effectively as possible.

• Protect more than just email
  Employees are using a diverse array of communication and collaboration tools to complete their work. Any security solution that uses AI to protect email exclusively is not enough. Look for wider solutions that take an ecosystem view to protect the other communication and collaboration tools used by employees, e.g., SharePoint, OneDrive, Slack, Zoom, and Teams. 

Conclusion

Cybercriminals will always seek new ways into organizations to compromise processes, steal information, and capture financial resources they have no right to. Email will continue to be one of the most common attack pathways, and as organizations have strengthened email security protections in recent years, cybercriminals have upleveled their attack methods to circumvent what has been put in place. In this new era of increasingly sophisticated AI-generated email threats, manually driven analysis and mitigation will continue to hinder underresourced security teams while increasing the threat of email attacks. AI capabilities in email security solutions have become an essential mechanism for organizations to detect, disrupt, and stop new and emerging attack methods, and offer significant protection promise for organizations due to their ethos of continual learning.

Every organization must reassess its email security strategy to ensure the right mix of protections is available to counter new and emerging attack methods. In line with the findings in this research, almost all organizations will need to deploy additional email security solutions that leverage AI to increase security efficacy beyond basic AI-enabled protections offered by cloud email providers. 

Sponsored by IRONSCALES

IRONSCALES is the leading cloud email security platform for the enterprise and the industry’s only solution that uses adaptive AI and human insights (HI) to stop advanced phishing. Its award-winning, self-learning platform continuously detects and remediates attacks like BEC, ATO, and VIP impersonation that bypass traditional security solutions.

Powerful, simple, and adaptive, IRONSCALES helps enterprises protect better, simplify operations, and empower the organization. IRONSCALES is headquartered in Atlanta, Georgia, and is proud to support more than 10,000 global enterprises.

Visit www.ironscales.com or @IRONSCALES to learn more.