The Perfect Doppelganger: How AI Is Changing Email Security

AI has changed the threat landscape for email security. Attackers can now use generative AI to create highly personalised, convincing messages that are designed to look completely normal – making traditional approaches based on rules, reputation and abnormal patterns increasingly difficult to rely on.

In this episode of CXO Secrets, David McClelland sits down with Alan LeFort, CEO and Co-Founder of StrongestLayer, to explore how email threats have evolved from simple phishing templates to sophisticated AI-powered attacks, and what organisations need to do differently to keep up.

Alan explains why AI-powered attacks are becoming increasingly difficult to distinguish from legitimate communications, how attackers are using personalisation and trusted infrastructure to evade existing defences, and why understanding intent and context is becoming critical to detecting threats that have never been seen before.

The conversation also explores the role of humans in cybersecurity. Rather than treating people as the weakest link, Alan argues that organisations should give employees the right protection and use their business knowledge and context as part of the security process.

Topics include:

• How email threats have evolved across three generations of attacks
• Why traditional rules and reputation-based security are becoming less effective
• How generative AI is enabling highly personalised and convincing attacks
• The rise of “perfect doppelgangers” that can make malicious and legitimate emails almost indistinguishable
• Why attackers are using trusted brands and infrastructure to bypass security controls
• Understanding intent, context and personalisation when analysing email threats
• The rise of AI-powered and agentic approaches to email security
• Adversary-in-the-middle phishing and why it is difficult for traditional technologies to detect
• How attackers continuously evolve their techniques to bypass security controls
• Why humans should not be treated as the weakest link in cybersecurity
• Using employees’ business knowledge and context as part of the security layer
• The balance between security awareness and protecting people from threats they cannot reasonably be expected to spot
• Reducing false positives while improving threat detection
• The importance of feedback loops in building effective AI security systems
• How AI is changing the way security teams need to think about risk
• Designing organisations around AI, not just deploying AI tools
• Why leaders need to think differently about organisational structure in an AI-powered workplace
• The importance of becoming more of a generalist and developing strong mental models in the age of AI
• Alan’s leadership lessons from across cybersecurity, email security and AI