Industry News

AI Has Changed the Math on Email Threats — and on Defending Against Them

September 17, 2026

Randy Hall, CEO— AI-assisted and reviewed prior to publication.

For two decades, phishing emails carried built-in tells: clumsy grammar, a logo one shade off, a sender address that almost matched the real one. Generative AI has quietly erased most of those tells, and with them the arithmetic that made yesterday's spam filters and yesterday's "spot the fake" training slides good enough. For managed service providers, this is not a marginal uptick in junk mail volume. It is a change in what "protected" actually means for every client inbox on the books.

The short version: AI has made phishing cheaper to produce, harder to spot by eye, and measurably more likely to get clicked, while handing defenders comparable machine-speed tools to catch what humans and static filters now miss. Microsoft's own telemetry found that AI-crafted phishing lures pulled a 54% click-through rate in testing, against 12% for traditionally written lures, a gap that changes the return on every attack an adversary sends.

What Changed in the Math of Email Threats?

The old economics of phishing rewarded volume over quality, because writing a genuinely convincing, personalized lure took a human attacker real time. Generative AI collapsed that tradeoff. Attackers can now produce grammatically clean, contextually specific messages in seconds, and Microsoft's Security Insider threat landscape page describes AI-driven phishing as now three times more effective than traditional campaigns, part of a broader shift toward attackers favoring phishing and unpatched assets as entry points.

That shift shows up directly in outcomes. The same report puts Microsoft's own detection scale in perspective: the company screens roughly 5 billion emails a day for malware and phishing threats, which gives some sense of how much of this fight now happens at machine speed on both sides.

Verizon's Data Breach Investigations Report tells a parallel story from the victim side. Across the incidents it analyzed for the EMEA region, phishing continued to show up as a leading incident pattern, and the report's authors were explicit that a multi-layered defense strategy is what the data actually calls for, not a single control. Volume and sophistication are rising together, which is exactly the combination that breaks defenses built for one or the other.

The New Numbers Behind AI-Powered Phishing

Behind the headlines, three data points matter most for an MSP building a defense plan.

None of these numbers describe a future threat. They describe last year's baseline, and the FBI's Internet Crime Complaint Center annual report tracks cyber-enabled fraud, the category that includes phishing and business email compromise, as a major driver of the losses reported to the bureau each year. Business email compromise alone remained one of the costliest categories of complaint the FBI tracked, and it is precisely the category where a single convincing, well-timed email can trigger a six or seven figure wire transfer.

Why Old Detection Signals No Longer Work

Spelling errors and awkward phrasing used to be free signal. AI has taken that signal away, and it is not coming back. A lure written by a language model is fluent by default, and it can be tuned to a target's industry, role, and even writing style if the attacker has scraped enough public material to prompt it correctly.

That leaves defenders needing signals that do not depend on how an email reads. Domain authentication is one of the few that still works regardless of how polished the text is, because SPF, DKIM, and DMARC validate who is actually allowed to send as a domain rather than judging the tone of the message. Google's own sender guidelines make this concrete: senders who send more than 5,000 messages a day to Gmail accounts must set up SPF and DKIM authentication and publish a DMARC record for their sending domain. CISA's phishing guidance goes a step further for defenders trying to stop impersonation of their own domain, recommending organizations ensure DMARC is set to reject for sent emails so that spoofed messages are rejected at the mail server before delivery.

Identity controls matter just as much once a lure gets through. NIST's small business guidance on multi-factor authentication is direct about this, pointing out that some forms of MFA are more susceptible to phishing than others, including one-time codes sent by SMS, while FIDO authenticators paired with the W3C Web Authentication API are the most common phishing-resistant option widely available today.

Can MSPs Still Win This Fight?

Yes, but only by treating email defense as a layered system rather than a single filter, and by verifying that layer regularly instead of assuming it holds. The tools that work against AI-generated phishing are largely the same tools that worked before: domain authentication, phishing-resistant MFA, and continuous monitoring. What has changed is the margin for error, because a single missing DMARC record or an unenforced policy now gets discovered by attackers faster, at greater scale, and with better-crafted lures than it did three years ago.

This is where the operational reality for MSPs gets harder before it gets easier. A client's DNS records do not announce when they drift out of alignment. A DMARC policy quietly left at "none" instead of "reject" looks identical to a properly enforced one until someone actually checks it. Multiplied across dozens or hundreds of client domains, that kind of silent drift is exactly the gap that AI-scaled attackers are positioned to find first.

A few practical checks separate MSPs who are actually reducing client risk from those who are only assuming they are:

• Confirm every client domain has SPF, DKIM, and a DMARC record, and that the DMARC policy is set to quarantine or reject rather than left at monitor-only.
• Verify MFA enforcement extends to admin and privileged accounts, not just end users, since those are the accounts a successful phishing click can escalate into.
• Re-scan domains on a schedule rather than once at onboarding, since DNS misconfigurations and expired records accumulate quietly over time.

Building a Layered Defense That Accounts for AI

None of this requires exotic tooling, but it does require visibility that scales across a client book instead of a single domain. ActiScan was built around that specific gap: continuous scanning of DMARC, SPF, and DKIM posture across every client domain an MSP manages, surfaced in a dashboard built for technicians who need to triage dozens of domains rather than audit one at a time. Teams that are new to this workflow can walk through the setup in the getting-started guide, which maps directly onto the authentication gaps described above.

The pricing structure is built around the reality that MSPs manage client counts that change month to month, so teams evaluating the platform can review current plans on the pricing page before committing to a tier. For MSPs ready to see where their client domains currently stand, creating an account through the signup page is the fastest way to get a baseline scan running today rather than after the next incident forces the question.

The Bottom Line for MSPs

AI has not made email security unwinnable. It has made the losing move, which is treating authentication and monitoring as a one-time setup task, more expensive than it used to be. The MSPs who come out ahead in this cycle will be the ones who can prove, domain by domain and on a recurring basis, that the controls their clients are paying for are actually enforced rather than merely present. That proof is now the product, not a side benefit of it.