AI Raises the Stakes for Email Security and Vulnerability Response

Cybersecurity teams are facing a split-screen problem in October 2026. AI is helping defenders understand threats, but it is also giving attackers new ways to create convincing phishing, business email compromise, account takeovers, deepfakes, and other social engineering attacks.

IRONSCALES sits at the center of that challenge. The AI-powered email security company protects organizations against these threats, and its technology is used by more than 18,000 organizations. Its defenses also draw on intelligence contributed by a community of more than 36,000 security professionals.

Audian Paxson, Principal Technical Strategist at IRONSCALES, works in a field that has changed since the early days of email security. “When we started fighting phishing in the early 2000s, the biggest problem was awareness, and filters could only judge a sender’s domain reputation.”

AI Is Changing Both Attacks and Defenses

Email security once focused on whether a message came from a trusted domain. Today, defenders must also judge whether a message imitates a real person, copies a familiar business process, or uses synthetic media to create confidence. Deepfakes and other social engineering threats make that human trust harder to protect.

AI systems also face their own limits when they analyze threats. Anthropic found that Claude Mythos 5 could recognize signs of the real internet when those signals appeared independently, but the model largely failed to act on the same evidence while immersed in a task. That gap matters because recognizing a warning and responding to it are different abilities.

Google Threat Intelligence Group reported its first AI-developed zero-day in May 2026. At the same time, the scale of AI-assisted vulnerability discovery has not translated into widespread exploitation. Of 1,061 vulnerabilities attributed to AI-assisted discovery in the first half of 2026, 14, or 1.3%, have been confirmed exploited in the wild.

VulnCheck’s findings fit with the UK’s National Cyber Security Centre assessment that fully automated, end-to-end attacks remain unlikely before 2027. That does not remove the risk. It means the current problem still involves systems, people, and security teams working together, even as AI expands what attackers can discover and produce.

The Vulnerability Backlog Is Becoming a Bigger Target

Verizon’s 2026 Data Breach Investigations Report put vulnerability exploitation at 31% of initial access. The number of vulnerability instances recorded by Verizon rose from roughly 68.7 million in 2022 to 527.3 million in 2025, creating a much larger pool for defenders to track and fix.

The response is falling behind that growth. Among the organizations surveyed, 51% take five or more days to patch critical flaws or cannot say what their mean time to patch is. Full remediation of vulnerabilities in CISA’s Known Exploited Vulnerabilities catalog dropped from 38% to 26%, while the median time from detection to full remediation stretched from 32 days to 43 days.

Manual work sits behind much of the delay. Automox security manager Ryan Braunstein put it plainly: “Manual work is the new attack surface.” The figures support that warning: 43% of teams spend 10 or more hours a week on manual endpoint work, while only 6% are fully automated in endpoint management.

Mondoo’s figures show the same pattern in vulnerability remediation. Sixty-two percent of organizations remediate vulnerabilities by hand, 2% are fully automated, and only 9% are confident important vulnerabilities get fixed on time. Automation can reduce repetitive work, but teams still need controls that let them supervise what systems change.

Practitioners asked for automatic rollback at 43%, the ability to pause or override at any time at 42%, and role-based access controls and audit logs at 42%. Those preferences point to a practical model for AI security: let systems handle routine actions, but keep people able to inspect, stop, or reverse them.

Skills and Context Will Shape the Next Phase

Cybersecurity expertise remains a major barrier. Shortages of cybersecurity expertise rank second among barriers to resilience at 57% in the public sector, while 46% of small organizations report insufficient expertise. More automation may help close that gap, but it will not replace the need for people who understand business systems, internet signals, and the consequences of a wrong decision.

Saint Leo University will require every student from fall 2026 to earn a baseline AI certification through IBM’s SkillsBuild platform, along with at least two credentials tied to their field. Saint Leo University president Dr. Jim Burkee described the goal this way: “We’re pushing forward and doubling down at the same time. We have to prepare our students to use AI and understand the tools – and in the same breath, we’re leaning harder into what’s always mattered: more human, more face-to-face teaching.”

That balance reaches beyond education. Censys’ 2026 State of the Internet Report reveals that AI adoption is expanding what businesses need to secure and why modern defense requires current Internet context. Security teams cannot protect what they cannot see, and old assumptions about domains, devices, and trusted activity no longer cover the full attack surface.

The lesson from email security, vulnerability management, and AI research is direct: better tools matter, but judgment remains central. IRONSCALES, Anthropic, Google Threat Intelligence Group, Verizon, CISA, Automox, Mondoo, VulnCheck, Censys, and the UK’s National Cyber Security Centre each highlight a different part of the same challenge. AI is changing the speed and shape of cyber threats, while resilient defense depends on visibility, trained people, careful automation, and the ability to take control when systems make the wrong call.

Stay connected via Google News

Follow us for the latest AI News