Email Security in the Age of AI | Josh Kamdjou, Sublime Security CEO

Email security remains a critical challenge due to the difficulty of distinguishing sophisticated phishing attacks from legitimate communication, especially at scale. Traditional detection models struggle with the rapid evolution of threats, often requiring lengthy retraining processes and failing to adapt to customer-specific contexts. Attackers exploit these limitations through techniques like multi-chain evasion, living off trusted services (e.g., DocuSign), and using encoded characters in calendar invites, making detection increasingly complex. Despite infrastructure improvements like SPF and DKIM, email's open design continues to make it a prime attack vector.

The rise of generative AI has dramatically shifted the threat landscape, enabling adversaries to launch high-volume, highly targeted attacks with unprecedented speed and sophistication. Open-source AI models without guardrails allow attackers to automate and scale campaigns, including prompt injection and self-evolving phishing content, outpacing traditional defenses. While AI also offers defensive potential - such as autonomous security analysts and AI-generated detection code - the current imbalance favors attackers. The discussion highlights emerging risks like cognitive overload from information manipulation ("meta war"), where control of technology influences human perception and decision-making, underscoring the deeper societal implications of cyber threats.

• What if you built an AI-powered email triage agent tailored to your own communication patterns?

  • Move: Develop a lightweight, local LLM-based agent that analyzes your incoming emails for urgency, tone shifts, and behavioral anomalies (e.g., vendor invoice changes), using only your historical data.
  • Why Now?: Generative AI now enables personalized models that can run efficiently on consumer hardware; delaying means continued exposure to evolving phishing tactics that bypass generic filters.
  • Expected Upside: Reduce false positives by 40%+ compared to standard filters while catching subtle social engineering attempts specific to your workflow - giving you back time and reducing cognitive load.

• What if you weaponized attacker logic to test your own SaaS product's vulnerability to living-off-the-land email attacks?

  • Move: Simulate multi-chain attacks against your own system - e.g., send yourself emails with benign-looking links to trusted platforms (like DocuSign or Google Calendar) containing encoded payloads in metadata or titles using Base64/Unicode obfuscation.
  • Why Now?: Adversaries are already exploiting trusted services and calendar invites at scale; if you don't validate your detection gaps now, your customers will be the ones to expose them.
  • Expected Upside: Uncover blind spots in your app's input validation and threat detection logic before attackers do - building differentiated security into your product as a feature.

• What if you replaced static dependency pinning with an agentic updater that evaluates each update for risk using AI-driven context?

  • Move: Build a Python/Go script that monitors your project dependencies, uses an LLM agent to analyze commit diffs, author history, CVE databases, and package behavior changes - then auto-approves or flags updates based on risk scoring.
  • Why Now?: Auto-updating introduces supply chain risks, but manual updates leave known CVEs unpatched; AI now allows contextual, real-time trade-off analysis that wasn't feasible before.
  • Expected Upside: Achieve 90%+ patch coverage within 24 hours of release without introducing malicious or compromised packages - balancing speed and safety in a way few solo devs can match.

• Implement a distributed, customer-specific detection system to rapidly adapt to new email threats within hours instead of weeks.
• Analyze multi-chain attack paths in emails by combining URL, attachment, and metadata inspection to detect abuse of trusted services like DocuSign.
• Monitor for malicious use of Unicode and encoded content (e.g., Base64 in calendar invites) as stealthy malware delivery vectors.
• Build automated detection logic using AI-generated code (e.g., Python scripts) to keep pace with evolving phishing tactics and reduce manual engineering lag.
• Prioritize provenance analysis over reputation alone by inspecting domain age, sending patterns, and behavioral context - even for emails from typically trusted sources.