Fighting GenAI with GenAI: How Email Security is Changing

Phishing has been a staple of cybercrime since the mid‑1990s, used to steal data or deliver malware. Today, the FBI reports that roughly 26 % of all cybercrime complaints are phishing‑related and that losses from these attacks have jumped 274 % in the last couple of years. The surge is not just a numbers story, generative artificial intelligence (GenAI) is reshaping how attackers craft their bait.

Why GenAI is a game‑changer for attackers

Large language models let threat actors generate highly personalised, multilingual phishing emails at almost no cost. They can produce perfect phishing templates, complete with convincing language and localised details, with a single click. This removes the traditional constraints of time and expertise, allowing campaigns to scale to thousands of victims while ironing out classic tell‑tale signs such as poor grammar.

The defender’s cost dilemma

Running every inbound message through a frontier‑level large language model would be about 100 × too expensive for most security teams. The cost asymmetry means defenders cannot simply mirror the attackers’ use of GenAI across the entire mail flow.

New defensive approaches focus on intent

Instead of relying on surface‑level anomalies, newer solutions try to model the attacker’s intent. By analysing the context and purpose of an email, they aim to flag malicious messages before any damage occurs. This shift from pattern matching to intent analysis is a direct response to the sophistication that GenAI brings.

Photo by Dan Nelson on Pexels

INKY Smart Insights: GenAI‑powered triage

Kaseya’s INKY Smart Insights applies GenAI to automate the first minutes of email investigation. It reduces a manual review that could take minutes to a few seconds of automated triage. The service also generates a plain‑language narrative explaining why it flagged a message, which helps administrators, even those without deep email‑security expertise, cut through alert fatigue.

What this means for your organisation

• Speed: Automated triage frees security staff to focus on higher‑impact incidents.
• Clarity: Narrative explanations turn technical findings into actionable insight.
• Scalability: By targeting only suspicious messages for deep analysis, the approach keeps costs in check while still leveraging GenAI.

Practical steps for MSPs and in‑house teams

1. Evaluate intent‑based email filters, Look for solutions that assess the purpose of a message rather than just its format.
2. Pilot automated triage, Test a GenAI‑driven tool on a subset of traffic to gauge reduction in false positives.
3. Train users on sophisticated phishing, Emphasise that language quality is no longer a reliable signal.
4. Monitor cost metrics, Track the expense of any large‑model analysis to ensure it stays within budget.
5. Keep threat intel up to date, Regularly ingest feeds that highlight emerging GenAI‑crafted phishing trends.

The broader picture

Phishing remains the most common entry point for cybercrime, a fact that has held steady since the mid‑1990s. The FBI’s data shows that a quarter of all cybercrime complaints now involve phishing, and the financial impact has risen dramatically. Generative AI amplifies these threats by making each email look more authentic, while defenders grapple with the economics of analysing every message with the same technology.

Photo by Jakub Zerdzicki on Pexels

Terms used in this article

• GenAI (generative artificial intelligence): AI that creates new content, such as text, images or code, based on patterns it has learned.
• Large language model (LLM): A type of GenAI that can understand and generate human‑like text.
• Intent analysis: Examining the purpose behind a message rather than just its superficial characteristics.
• Alert fatigue: When security staff become desensitised because they receive too many warnings, many of which are false positives.

Stay ahead of the curve by matching the sophistication of the threat with equally advanced, cost‑effective defence.