Email Security: from Spam Filters to AI agents

Email security started as a spam problem. Mail admins ran filters on their own servers: Apache SpamAssassin, first released in April 2001, scored each message with hundreds of hand-written rules, DNS blocklists, and later a Bayesian classifier. If the score crossed a threshold, the message went to a junk folder.

As volume grew, the filter moved into a box. IronPort, Barracuda and others sold appliances that sat in front of Exchange or Lotus Notes, checked sender reputation, ran antivirus signatures, and dropped or quarantined mail before it reached the server. Cisco bought IronPort for $830 million in 2007, which tells you how central the gateway had become.

What broke was the model itself. Rules and signatures only caught what someone had already seen. Spammers rotated domains and wording faster than admins could write rules, and nothing in SMTP proved who actually sent a message. SPF in 2006 and DKIM in 2007 were the first attempts to fix that, and adoption was thin for years.

The gateway moved to the cloud. Postini already filtered mail as a hosted service, and Google bought it in 2007 for $625 million. Mimecast and Proofpoint built cloud secure email gateways: you pointed your MX records at them, and every message passed through their data centers before reaching your mailbox.

When companies moved to Office 365 and Google Workspace, Microsoft added its own layer. Exchange Online Advanced Threat Protection, announced in 2015, brought sandboxed attachments and click-time link checks to the mailbox itself. DMARC, published as RFC 7489 the same year, finally let a domain owner tell receivers what to do with mail that failed SPF or DKIM.

The attackers adapted. Malware got detonated in sandboxes, so they sent clean messages instead: a fake invoice, a wire request from the "CEO", a credential page hosted on a trusted cloud service. The gateway saw a well-formed email from a domain with decent reputation and let it through. When an account did get taken over, the damage spread from inside the tenant, which is why my checklist for a hacked email account starts with sessions and forwarding rules, not passwords alone.

The next shift was where the product sat. Instead of rerouting mail, a new wave of vendors connected to Microsoft 365 and Google Workspace through APIs and read mail after delivery. Abnormal, Material and Sublime built baselines of who normally talks to whom, how a vendor usually writes, and what a normal payment request looks like, then flagged the message that broke the pattern.

This caught what gateways missed: the payload-free BEC email, the compromised vendor account, the internal account sending odd requests. Because the products sat inside the tenant, they could also pull a message back out of every inbox after the fact. The category got a name, integrated cloud email security, and the incumbents consolidated: Thoma Bravo took Proofpoint private for $12.3 billion in 2021 and Permira bought Mimecast for $5.8 billion in 2022.

Machine learning still scored and suggested; people still decided. Analysts reviewed the flagged queue, worked the abuse mailbox, and ran awareness training on a quarterly calendar. I wrote about building a phishing defense framework in this period, and the hard part was always the human queue, not the filter. Then Google and Yahoo moved authentication from good practice to requirement: from February 2024, bulk senders to Gmail needed authentication, one-click unsubscribe and a low spam rate.

The agentic era started in the abuse mailbox, because that is where the toil was. Abnormal's AI Security Mailbox, announced in May 2024, judges every user-reported email, bulk-removes the unreported copies from the same campaign, and replies to the employee with a verdict. Microsoft's Phishing Triage Agent in Defender, announced in March 2025 and now generally available, runs when a user reports a message, detonates files and links, classifies the alert, and closes false positives on its own. Microsoft says each report could take an analyst up to 30 minutes.

Sublime Security went furthest on autonomy. Its Autonomous Security Analyst (ASA) investigates reported and flagged messages, usually within about a minute, and in Autonomous Mode applies whatever remediation you configured per verdict. Its Autonomous Detection Engineer (ADÉ) writes and backtests new detections, then submits them for analyst approval. Proofpoint announced Satori Agents, including an Abuse Mailbox Agent, with phased availability from 2026.

The limits are real and the vendors say so. Microsoft's agent resolves false positives but leaves true positives open for an analyst. Sublime ships ASA inactive and recommends a week or two in a passive mode first, and unknown verdicts always go to a human. The agents also need identities: Microsoft's setup wizard creates an Entra Agent ID with scoped read permissions. That is the point I keep making in AI agents don't have passwords: an agent that can quarantine mail across a tenant is a privileged identity and needs to be governed like one.

One more change: email is now an attack path into AI assistants. Proofpoint and others warn that prompts hidden in email can steer a copilot that reads the inbox, and Material now sells guardrails that keep agents away from password resets and magic links.

My bet: by 2031, agents handle user-reported and flagged mail end to end at most mid-size and large companies, and the analyst's job is reviewing exceptions and the agents themselves. Triage is already mostly solved. The open problem is that AI makes a convincing lure free to produce, in any language, in the voice of your actual CFO.

That pushes the industry from "does this look like phishing" to "can this sender prove who they are". DMARC on the Standards Track is a start for domains, but the bigger shift is verifiable identity on the request itself: signed payment instructions, out-of-band confirmation that an agent can trigger, and provenance for voice and video. The $25 million deepfake case is the warning: once a video call can be faked, an email "confirmed on a call" proves nothing.

The second shift is that many emails will be written and read by agents, not people. Email security then has to inspect machine-to-machine requests, block instructions hidden in mail aimed at assistants, and check that the agent acting on a message had the scope to do so. Mimecast's Agent Risk Center, planned for general availability in January 2027, is an early sign of that convergence.