AI Has Changed the Math on Impersonation.
AI has revolutionized impersonation attacks by increasing speed, volume, and believability, making traditional defenses obsolete as Business Email Compromise caused over $3 billion in losses in 2025.
Impersonation attacks have evolved dramatically with AI, enabling attackers to craft highly convincing messages at unprecedented speed and scale. Finance managers now receive perfectly crafted emails from seemingly legitimate suppliers, complete with authentic writing styles and real invoice references, making these attacks nearly impossible to detect through traditional means.
The traditional warning signs of impersonation—awkward phrasing, generic greetings, translation errors—have been eliminated by generative AI that can draft flawless executive emails in seconds, perfectly mimicking the target's language and tone. This allows attackers to create unique, well-researched messages for individual targets rather than using generic templates.
Business Email Compromise (BEC) resulted in more than $3 billion in reported losses in 2025, according to the FBI's Internet Crime Complaint Center (IC3) report. This figure represents more than 94 times the losses reported for ransomware, highlighting the severity of this threat despite existing phishing training programs.
Email Authentication Foundation
Email authentication through SPF, DKIM, and DMARC forms the foundation of impersonation defense, but proper enforcement remains challenging. Many organizations publish DMARC records without implementing reject or quarantine policies due to concerns about blocking legitimate mail from marketing platforms, CRMs, or partner systems.
Effective authentication requires ongoing visibility into all systems sending on behalf of your domain, careful implementation to maintain deliverability, and continuous monitoring to address new senders as they emerge. This represents an ongoing hygiene practice rather than a one-time solution.
Lookalike Domain Threats
Authentication protects real domains but does nothing against lookalike domains registered by attackers. These domains—created with swapped letters, extra hyphens, different top-level domains, or homoglyphs—target customers, partners, and employees without any connection to authenticated infrastructure.
Proofpoint research found that 82% of organizations monitored had lookalike domains registered against at least one of their domains during a 30-day sample in August 2026. Effective monitoring correlates new registrations against brand terms and enables quick takedowns before domains are used for attacks.
Application and AI Agent Risks
Organizations now send more email from applications and systems than from human inboxes, creating a new attack surface. Billing platforms, HR systems, ticketing tools, and marketing automation all send as your domain but often bypass security reviews designed for human email.
AI agents have added another dimension, drafting outreach, sending updates, and initiating email on behalf of users. Compromised or manipulated agents can send at volumes and speeds impossible for humans, requiring all sending systems—human or machine—to be authenticated, inventoried, and monitored equally.
Supplier Account Compromise
The most difficult impersonation attacks involve compromised supplier accounts, which use real domains, proper authentication, and existing business relationships. These attacks bypass traditional filters and are typically detected through behavioral changes rather than content analysis.
These attacks typically surface through behavior, not content: a sudden shift in payment instructions, a new tone in the writing, a request that breaks from the normal pattern of the relationship, a login or sending pattern from a location that account has never used.
Proofpoint research revealed that 93% of sampled organizations had received threats originating from supplier domains during the same 30-day evaluation period. Catching these attacks requires visibility into supplier behavior over time and adaptive controls that can isolate risk without disrupting legitimate business relationships.
Related
