11/05/2026

AI Has Changed the Math on Impersonation.

ProofPoint

AI Has Changed the Math on Impersonation.

Your Defenses Need to Catch Up.

A finance manager gets an email from a supplier's real inbox, using the supplier's real writing style, referencing a real invoice number, asking to update payment details. Nothing about it looks wrong. That is the point.

Impersonation attacks are not new. What has changed is what AI does to them: it increases the speed attackers move, the volume they can produce, and the believability of what lands in the inbox. Generative models can draft a flawless executive email in seconds, in the target's own language, matched to their tone. Attackers no longer need to write a template and hope it works across a thousand targets. They can generate a unique, well-researched message for every single one.

The old tells are gone. Awkward phrasing, generic greetings, obvious translation errors: these used to be the signals that trained employees to spot a fake. AI has closed that gap. A lookalike domain now pairs with a perfectly worded email. A compromised supplier account now sends a message an AI model wrote to match twelve months of prior correspondence. Volume and precision used to be a trade-off for attackers. AI removes it.

Business Email Compromise (BEC) drove more than $3 billion in reported losses in 2025, according to the FBI’s 2025 Internet Crime Complaint Center (IC3) report. That is more than 94 times the losses reported for ransomware. These losses do not come from a lack of phishing training. They come from identity abuse, an attack surface traditional email filtering alone cannot address.

Email authentication is the foundation, not an add-on

Most impersonation attacks succeed because it is still possible to send email that claims to be from a domain without actually being authorized to send from it. SPF, DKIM, and DMARC exist to close that gap. Enforced correctly, they tell receiving mail systems exactly who is allowed to send as your domain, and what should happen to messages that fail the check.