AI has broken the assumptions behind behavioral detection

For years, email security has asked one question: does this look different from normal. A link that doesn't match known good domains. An attachment that trips a signature. A sender behaving outside their usual pattern. That approach rests on an assumption: attacks look different from legitimate activity, so deviation from a baseline is something worth flagging.

 AI has broken that assumption. Attackers can now research a target in minutes using public information, draft a lure that matches the tone and context of that specific relationship, and iterate a campaign faster than any static baseline can update to catch it. The result is attacks that don't deviate from normal because they were built, deliberately, to look exactly like it.

 A supplier's mailbox gets compromised. The attacker reads months of real correspondence, then replies inside a live thread, quoting an actual purchase order, from a genuine account. No malware. No link. No lookalike domain. Nothing a rule was ever written to catch, and nothing for a behavioral model to flag as unusual, because nothing about it is.

Behavioral detection was built to catch deviation. AI-accelerated attacks are built to avoid it. Closing that gap takes a different question entirely: not does this look different, but what is this actually trying to accomplish, and does that hold up.

What is intent?

Intent is the answer to that question, and it only works if you're reading two sides at once: what the content is trying to do, and whether that request makes sense given the relationship it's coming through.

 This is where behavior-only approaches run out of road. A model trained purely on behavioral deviation, watching for a sender acting outside their own history, can tell you something changed. It can't tell you whether what changed is actually malicious, because it has no independent read on attacker technique, no visibility into campaign infrastructure, no sense of what's hitting other organizations right now. It's reasoning with half the picture, and it's the half that doesn't catch the attacks that were built to look normal in the first place. A compromised supplier replying inside a real thread doesn't deviate from anything. There's no baseline for behavioral detection to compare it against, because nothing about the behavior changed, only what's being asked.

 Getting a full read on intent means combining two things that most vendors only have one of:

Attacker intent

What the content is actually trying to achieve, and through what technique. This is the side most detection has always looked at, what does the message contain, but getting a reliable signal takes more than scanning the message in front of you. It comes from:

• Known campaign infrastructure. Domains, IPs, and sending patterns already tied to active phishing or BEC campaigns elsewhere, often before they ever reach your organization.
• Industry attack patterns. A technique that looks isolated inside one company can be unmistakable once it's compared against what's hitting peer institutions in the same industry.
• Compromised suppliers. Intelligence on vendor accounts already known to be compromised, even when that vendor isn't a Proofpoint customer. Scale matters here: Proofpoint analyzes 2.37 trillion emails, 19.5 trillion URLs, and 1.27 trillion attachments a year across more than 3.4 million customers, which means we often see a compromise inside a supplier or partner before it ever reaches you.
• Emerging campaigns. New techniques caught in the act, correlated across seemingly unrelated messages by shared objective rather than shared content.

Business intent

Whether a request makes sense given the relationship, the workflow, and the person it's coming from. This is the side behavioral-only detection never really had access to, because it requires understanding an organization's normal, not just flagging a change from one account's history. It comes from:

• VIPs and targeted individuals. Knowing who holds outsized access or approval authority, and what a request aimed specifically at them should look like, rather than relying on a manually maintained list.
• Access to sensitive data. What systems and information a person can actually reach, so a request that would expose something significant gets weighed differently than one that wouldn't.
• Business processes. How approvals, payments, and vendor relationships normally flow, so a request routed through an unusual path stands out even when the content looks ordinary.
• Topics and tone. The normal subject matter and communication style of a given relationship, so a message that's topically or tonally off, even subtly, registers as a signal.
  
  A finance approver gets wire transfer requests constantly, that's not suspicious on its own. The same request routed through an unusual approval chain, from a vendor relationship with no history of this kind of ask, is a different story even though the content looks identical. Attacker intent alone can't tell those two apart. Neither can behavior alone. It takes both.

What does it take to actually create intent-based protection?

Understanding both sides of intent is necessary, but it isn't sufficient on its own. Turning that understanding into protection takes three layers working together.

 A knowledge graph that connects both sides. Attacker intelligence and business context are only useful if they're connected to each other. A graph that knows about a compromised supplier but nothing about who at your organization talks to that supplier, or how often, can't actually reason about intent, it can only flag the supplier. The Proofpoint Knowledge Graph ties attacker-side signals, campaigns, infrastructure, compromised accounts, to business-side signals, relationships, access, workflows, communication patterns, so a decision can account for both at once.

 A reasoning model that asks the right question. A graph full of context still needs something to interrogate it. The model's job is to evaluate a message's objective, check whether that objective is plausible given the relationship, and weigh the technique being used to pursue it, resolving most decisions quickly and pulling only the genuinely ambiguous cases into deeper analysis. This is the difference between matching against known-bad and reasoning about what's actually being asked.

 An agentic layer that acts on the answer. Knowing a message is suspicious doesn't stop it, investigate it, follow it past the inbox, or protect the person it was aimed at. That takes agents: software that can take the model's reasoning and turn it into blocking a message before delivery, reconstructing an attack after one gets through, extending protection into the browser, or adapting defenses around a specific person's risk, continuously, without waiting for an analyst to act on every decision by hand.

Graph without a reasoning model is just data. A reasoning model without agents is just an alert. All three together is what actually changes outcomes.

But intent isn't something that happens once, at the moment of detection, and then hands off to separate tools for whatever comes next. The same reasoning, what is this trying to accomplish, and does that hold up given who's involved, has to run at every point where a decision gets made: before delivery, during investigation, at every control point past the inbox, and in deciding who's actually at risk before an attack ever arrives. That's four different jobs, not because intent stops mattering after detection, but because intent has to be re-applied, asking a different version of the same question, at each one.

What does an ideal solution look like for AI-accelerated threats?

With intent reasoning and an agentic layer in place, the question isn’t just what that system does at the moment a message arrives, it’s where else that same reasoning needs to run. Four capabilities, each applying intent to a different decision:

1. Stop novel threats with speed and efficacy. Intent-Based AI reasoning at the point of delivery, catching attacks before they land, including ones with no prior pattern to match against, without trading speed for scrutiny.
2. Contain blast radius at machine speed. Intent reasoning applied to investigation, identifying which messages and actions actually belong to the same attack because they share an objective, not because they share content.
3. Continuous protection beyond the inbox. Intent reasoning extended to every control point an attack can reach, including the browser, so a decision there draws on the same understanding of what’s plausible, not a separate rule set.
4. Reduce real user risk. Intent reasoning applied proactively, identifying who’s actually likely to be targeted based on access and exposure, and continuously adapting protection around them rather than relying on a static list.

This is exactly the framework behind what we announced at Protect 2026. The Proofpoint Agentic Collaboration Security system is built on the Knowledge Graph and the Nexus Intent-Based Detection Model described above, with capabilities that put that same reasoning to work in each of these four areas: two new models - Extended and Deep Thinking - for stopping novel threats, Autonomous Threat Investigation for containing blast radius, Advanced Browser Protection for extending past the inbox, and Privileged User Protection along with the Red Team and Blue Team User Risk Agents for reducing user risk.
 

Looking ahead

The next post in this series will take each of these four capabilities in turn and shows how the system acts on intent in each one. Meanwhile, you can read more details on new innovations announced at Protect 2026 announcement here

Get Started

See Proofpoint's Intent Based Nexus AI in action. For the first time, get a deeper look in to Proofpoint's pioneering Nexus AI architecture.