AI Has Changed the Math on Impersonation.
Your Defenses Need to Catch Up.
A finance manager gets an email from a supplier's real inbox, using the supplier's real writing style, referencing a real invoice number, asking to update payment details. Nothing about it looks wrong. That is the point.
Impersonation attacks are not new. What has changed is what AI does to them: it increases the speed attackers move, the volume they can produce, and the believability of what lands in the inbox. Generative models can draft a flawless executive email in seconds, in the target's own language, matched to their tone. Attackers no longer need to write a template and hope it works across a thousand targets. They can generate a unique, well-researched message for every single one.
The old tells are gone. Awkward phrasing, generic greetings, obvious translation errors: these used to be the signals that trained employees to spot a fake. AI has closed that gap. A lookalike domain now pairs with a perfectly worded email. A compromised supplier account now sends a message an AI model wrote to match twelve months of prior correspondence. Volume and precision used to be a trade-off for attackers. AI removes it.
Business Email Compromise (BEC) drove more than $3 billion in reported losses in 2025, according to the FBI’s 2025 Internet Crime Complaint Center (IC3) report. That is more than 94 times the losses reported for ransomware. These losses do not come from a lack of phishing training. They come from identity abuse, an attack surface traditional email filtering alone cannot address.
Email authentication is the foundation, not an add-on
Most impersonation attacks succeed because it is still possible to send email that claims to be from a domain without actually being authorized to send from it. SPF, DKIM, and DMARC exist to close that gap. Enforced correctly, they tell receiving mail systems exactly who is allowed to send as your domain, and what should happen to messages that fail the check.
The problem is that enforcement is hard to get right. Many organizations publish a DMARC record and stop there, without moving to a reject or quarantine policy, because they are afraid of blocking legitimate mail from a marketing platform, a CRM, or a partner's system they forgot was sending on their behalf. That gap is exactly where attackers spoof a trusted domain and land in the inbox.
Getting to full enforcement takes visibility into every system sending on your behalf, a rollout plan that does not break deliverability, and monitoring after enforcement to catch new senders as they appear. This is not a one-time project. It is ongoing hygiene, and it is the first control that has to be in place before anything else in an impersonation strategy matters.
Lookalike domains need detection and remediation, not just awareness
Authentication protects your real domain. It does nothing for the domain an attacker registers to look like yours: a swapped letter, an extra hyphen, a different top-level domain, a homoglyph that reads identically at a glance. These domains get stood up to target your customers, your partners, and your own people, and they carry no relationship to your authenticated infrastructure at all.
Detecting these registrations early matters because the window between registration and use as an attack platform is short. Effective monitoring correlates newly registered domains against your brand terms and your suppliers' brand terms, flags the ones built to deceive, and gives your team the evidence needed to pursue takedown before the domain sends its first message. Detection without a remediation path just produces a longer list of confirmed threats sitting in your inbox.
The scale of this problem is larger than most security teams assume. In a 30-day sample from August 2026, Proofpoint® analyzed customers whose domains were under monitoring and found that 82% of these organizations had lookalikes registered against at least one of their own domains.
Application and machine-generated email is now part of your identity surface
Every organization sends far more mail from applications and systems than from people typing in an inbox. Billing platforms, HR systems, ticketing tools, marketing automation: all of it sends as your domain, and increasingly, none of it goes through the same security review as a person's inbox.
AI agents have added a new category to this list. Agents draft outreach, send status updates, generate reports, and increasingly initiate email on a person's behalf inside a workflow. An agent operating with valid credentials and a plausible task can send at a volume and speed no person could match, and a compromised or manipulated agent can do the same for an attacker. The identity behind the message matters as much as the content of it.
Securing this layer means every sending system, human or machine, is authenticated, inventoried, and monitored the same way. An unauthenticated application sending on your domain is not a minor gap. It is an open door that looks identical to the front door you already locked.
Compromised supplier accounts bypass every filter built for outsiders
The hardest impersonation attacks to catch are the ones that do not impersonate anything. A compromised supplier account is a real account, on a real domain, with real authentication, sending from inside a real business relationship. There is no spoofed header and no lookalike URL for a filter to flag. The attacker is simply using an account your organization already trusts.
These attacks typically surface through behavior, not content: a sudden shift in payment instructions, a new tone in the writing, a request that breaks from the normal pattern of the relationship, a login or sending pattern from a location that account has never used. Catching them requires visibility into supplier account behavior over time and threat intelligence that flags when a trusted sender starts acting like a different one, combined with adaptive controls that can isolate risk from a specific supplier without cutting off the relationship entirely.
This is not a fringe risk. During that same 30-day evaluation, Proofpoint research found that 93% of sampled organizations had been sent a threat originating from a supplier domain.
Where this leaves security teams
AI did not create impersonation. It removed the friction that used to slow attackers down and give defenders a chance to catch mistakes. Closing that gap takes all four pieces working together: authenticated domains, monitored lookalikes, secured application and agent email, and visibility into supplier account behavior. Treating any one of them as sufficient on its own leaves the others open.
Figure 1: Reducing impersonation risk requires multiple layers of protection
How Proofpoint Can Help
Proofpoint addresses each layer of impersonation protection. You can deploy capabilities individually to close a specific gap, or together through Collaboration Security Prime.
Authenticate your domains. Email Fraud Defense gives you visibility into every sender using your domain, and consultants help guide you to DMARC p=reject while minimizing disruption to legitimate mail.
Detect and remove lookalikes. Email Fraud Defense identifies lookalike domains and attempted hijacks. Proofpoint Takedown submits confirmed malicious domains to blocklists and works with registrars and hosts to pursue deregistration.
Secure application and agent email. Secure Email Relay routes email from applications, SaaS platforms, printers, and AI agents through one cloud relay that DKIM-signs and scans every message.
Catch compromised suppliers. Supplier Threat Protection learns your normal supplier communication patterns and surfaces suspected compromised accounts, with a prioritized list of high-risk senders for your team to act on.
Collaboration Security Prime: One Platform for Every Layer
Collaboration Security Prime brings all four layers together. It pairs Email Fraud Defense, Takedown, Secure Email Relay, and Supplier Threat Protection with Core Email Protection, which helps stop business email compromise, phishing, and malware. It also adds Account Takeover Protection, protection for messaging and collaboration apps, and human-risk training through ZenGuide and the Human Resilience Workbench. Instead of stitching together separate tools, you get coverage across every layer in a single offering.
To learn more, explore these resources:
- Stop Email Fraud and Hijacked Business Communications: a use case guide covering the tactics fraudsters use to hijack business communications, including how AI is making these attacks more effective, and the best practices to stop them.
- Authenticate Your Email with DMARC: guidance on deploying SPF, DKIM, and DMARC enforcement without breaking deliverability for legitimate senders.
- Impersonation Protection Solution Brief: an overview of how authentication, lookalike domain monitoring, and supplier account visibility work together against impersonation.
- Impersonation Attack Threat Reference: a breakdown of how impersonation attacks work and the tactics behind them.