Email Security: from Spam Filters to AI agents

Email security started as a spam problem. Mail admins ran filters on their own servers: Apache SpamAssassin, first released in April 2001, scored each message with hundreds of hand-written rules, DNS blocklists, and later a Bayesian classifier. If the score crossed a threshold, the message went to a junk folder.

As volume grew, the filter moved into a box. IronPort, Barracuda and others sold appliances that sat in front of Exchange or Lotus Notes, checked sender reputation, ran antivirus signatures, and dropped or quarantined mail before it reached the server. Cisco bought IronPort for $830 million in 2007, which tells you how central the gateway had become.

What broke was the model itself. Rules and signatures only caught what someone had already seen. Spammers rotated domains and wording faster than admins could write rules, and nothing in SMTP proved who actually sent a message. SPF in 2006 and DKIM in 2007 were the first attempts to fix that, and adoption was thin for years.

The gateway moved to the cloud. Postini already filtered mail as a hosted service, and Google bought it in 2007 for $625 million. Mimecast and Proofpoint built cloud secure email gateways: you pointed your MX records at them, and every message passed through their data centers before reaching your mailbox.

When companies moved to Office 365 and Google Workspace, Microsoft added its own layer. Exchange Online Advanced Threat Protection, announced in 2015, brought sandboxed attachments and click-time link checks to the mailbox itself. DMARC, published as RFC 7489 the same year, finally let a domain owner tell receivers what to do with mail that failed SPF or DKIM.

The attackers adapted. Malware got detonated in sandboxes, so they sent clean messages instead: a fake invoice, a wire request from the "CEO", a credential page hosted on a trusted cloud service. The gateway saw a well-formed email from a domain with decent reputation and let it through. When an account did get taken over, the damage spread from inside the tenant, which is why my checklist for a hacked email account starts with sessions and forwarding rules, not passwords alone.

The next shift was where the product sat. Instead of rerouting mail, a new wave of vendors connected to Microsoft 365 and Google Workspace through APIs and read mail after delivery. Abnormal, Material and Sublime built baselines of who normally talks to whom, how a vendor usually writes, and what a normal payment request looks like, then flagged the message that broke the pattern.

This caught what gateways missed: the payload-free BEC email, the compromised vendor account, the internal account sending odd requests. Because the products sat inside the tenant, they could also pull a message back out of every inbox after the fact. The category got a name, integrated cloud email security, and the incumbents consolidated: Thoma Bravo took Proofpoint private for $12.3 billion in 2021 and Permira bought Mimecast for $5.8 billion in 2022.

Machine learning still scored and suggested; people still decided. Analysts reviewed the flagged queue, worked the abuse mailbox, and ran awareness training on a quarterly calendar. I wrote about building a phishing defense framework in this period, and the hard part was always the human queue, not the filter. Then Google and Yahoo moved authentication from good practice to requirement: from February 2024, bulk senders to Gmail needed authentication, one-click unsubscribe and a low spam rate.

The agentic era started in the abuse mailbox, because that is where the toil was. Abnormal's AI Security Mailbox, announced in May 2024, judges every user-reported email, bulk-removes the unreported copies from the same campaign, and replies to the employee with a verdict. Microsoft's Phishing Triage Agent in Defender, announced in March 2025 and in public preview from August 2025, runs when a user reports a message, detonates files and links, classifies the alert, and closes false positives on its own. Microsoft (vendor-reported) says each report can take an analyst up to 30 minutes. Its documentation notes the agent is the same one as the Security Alert Triage Agent, whose expanded alert coverage is still in preview.

Sublime Security built its product around agents. Its Autonomous Security Analyst (ASA), launched in April 2025, investigates reported and flagged messages, typically in about a minute. In active mode it applies whatever remediation you configured per verdict. Its Autonomous Detection Engineer (ADÉ) writes and backtests new detections, then submits them for analyst approval. Proofpoint announced Satori Agents in September 2025, including one for user-reported email, with phased availability from 2026. No public general-availability date has been published, so treat it as announced, not shipped.

The past year was mostly money and consolidation. Sublime raised $150 million in October 2025 and cited ASA and ADÉ in the announcement. Proofpoint closed its $1.8 billion Hornetsecurity deal in December 2025, then said in March 2026 it would join its gateway and API products into one email architecture. In August 2026 Mimecast announced Managed Threat Response, a 24/7 service where AI triages every reported email and Mimecast analysts act on confirmed threats, and put an Agent Risk Center into beta. In September 2026 Sublime pointed ASA at outbound mail with an Email DLP add-on. No acquisition or shutdown of a major email security agent product turned up in this window.

The limits are real and the vendors say so. Microsoft's agent resolves false positives but leaves true positives open for an analyst. Sublime offers a passive mode that investigates and reports without touching mail, and unknown verdicts always go to a human. The agents also need identities: Microsoft's setup wizard offers a new Entra Agent ID with scoped permissions, and it warns that a reused user account inherits all of that user's access. That is the point I keep making in AI agents don't have passwords: an agent that can quarantine mail across a tenant is a privileged identity and needs to be governed like one.

One more change: email is now an attack path into AI assistants. In 2025 researchers showed a single crafted email could pull data out of Microsoft 365 Copilot with no click (the EchoLeak flaw, CVE-2025-32711, reported by Aim Labs). Proofpoint says attackers embed prompts in email to manipulate assistants such as Microsoft Copilot and Google Gemini, and announced detections for it. Material now sells guardrails that keep agents away from password resets and magic links.

My bet: by 2031, agents handle user-reported and flagged mail end to end at most mid-size and large companies, and the analyst's job is reviewing exceptions and the agents themselves. Triage is already mostly solved. The open problem is that AI makes a convincing lure free to produce, in any language, in the voice of your actual CFO.

That pushes the industry from "does this look like phishing" to "can this sender prove who they are". DMARC on the Standards Track is a start for domains, but the bigger shift is verifiable identity on the request itself: signed payment instructions, out-of-band confirmation that an agent can trigger, and provenance for voice and video. The $25 million deepfake case is the warning: once a video call can be faked, an email "confirmed on a call" proves nothing.

The second shift is that many emails will be written and read by agents, not people. Email security then has to inspect machine-to-machine requests, block instructions hidden in mail aimed at assistants, and check that the agent acting on a message had the scope to do so. Mimecast's Agent Risk Center, planned for general availability in January 2027, is an early sign of that convergence.