PROOFPOINT has warned that generative AI is erasing traditional behavioural tells in phishing and business email compromise (BEC) schemes, making messages fluent, personalised and unique to recipients. At Protect 2026, the company demonstrated campaigns where a single threat actor reached dozens of real estate agents within one organisation, each contact created from a different account and with tailored wording before closing the thread with a universal call to join a video meeting.
The shifting threat landscape is corroborated by broader data: the FBI’s Internet Crime Complaint Center logged more than 22,000 AI-related complaints in 2025 with about $900 million in losses, and 24,768 BEC complaints totaling roughly $3.05 billion. In short, attackers can craft convincing, contextually appropriate messages at scale, reducing signals that rely on recognisable templates or abnormal patterns.
To counter this, Proofpoint advocates a shift from behaviour-centric detection to intent reasoning, evaluating what a message is trying to achieve and the techniques used, rather than merely how it looks. The firm outlined a multi-layer approach—tiered detection models that sample most mail in under 500 milliseconds, with deeper analysis for a tiny fraction of messages, and an emphasis on intent across entire campaigns rather than single messages.
Its Threat Investigation Agent is designed to map blast radii across email, identity, messaging, browser and supplier activity, coordinating actions such as account takeovers and false positives. The examples shown, including a bank-detail change request and a RFP-themed credential phishing incident, illustrate how AI can shorten attacker timelines and train investigators to respond at machine speed.