COMMENTARY: Email security has become a board-level business continuity issue. Enterprise CISOs are explaining to executives why their teams burned an average of more than 160 analyst hours last quarter investigating legitimate business emails flagged as threats. That's $24,000 in fully-loaded analyst time—per quarter—just on false positives.The stakes are rising exponentially. Recent Harvard research shows AI can fool over 50% of humans, while reducing attack costs by more than 95% and increasing profitability up to 50-fold. For enterprise CISOs managing more than 10,000 mailboxes, this isn't operational pain—it's existential business risk.[SC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Read more Perspectives here.]Legacy email systems are failing at enterprise scale. With SOCs receiving more than 4,400 alerts daily and 43% being false positives, large enterprises investigate 600-1,900 false positives daily. At current analyst rates, that's $875,000 annually in wasted human capital—before calculating business disruption costs.Take a $50M vendor payment approval from the CFO during quarterly close. Legacy systems see urgent language, large financial amount, after-hours timestamp. Every pattern screams threat. Email gets quarantined. Business disrupted.Dual evidence architecture simultaneously runs two parallel investigations:The LLM judge weighs all evidence. Strong legitimacy indicators outweigh minor threat signals. The promise: Email clears automatically with 98% confidence. Business continuity maintained. Analyst focuses on actual threats.
Why legacy email security has hit a dead end
Both first and second-generation email security systems suffer from the same fundamental flaw: they're prosecutor-only systems that can only hunt for guilt, never prove innocence.First-generation pattern matching hunts for suspicious indicators using manually-crafted rules. When threats are novel, there are no patterns to match. Teams can't use regex to define "normal"—there are infinite legitimate business scenarios to manually code.Second-generation machine learning calculates threat probabilities based on historical attack data. When AI generates personalized, novel attacks with no historical precedent, statistical analysis fails completely. We also can't build ML models to detect legitimacy—the feature space is too vast, creating long-tail correlations that generate massive false positive rates.This creates an unsolvable FP/FN tension. Make the prosecutor more aggressive, and it’s possible to convict more innocent emails. Make it more cautious, and more threats escape. It's a zero-sum trade-off that we can never solve within a prosecutor-only architecture.Here's why all of this will become catastrophic: AI has made hyper-personalized attacks go from rare, nation-state capabilities to commonplace, commodity threats. Traditional systems are essentially blind to threats they've never seen before.Give every email its day in court
We’re now starting to see the rise of third-generation email security platforms that use LLMs as the central coordinator of analysis, not as a bolt-on module. This architectural shift from "LLM-as-assistant" to "LLM-as-master" enables fundamentally different capabilities.These tools break the prosecutor-only paradigm entirely. Every email gets its day in court. Our system acts as both public defender and prosecutor, while an impartial LLM judge weighs the evidence and renders verdict.When AI creates novel attacks with no historical precedent, pattern-matching fails. But these architectures focus on stable indicators that persist regardless of attack novelty:- Business legitimacy patterns are consistent. The CFO still has the same communication style. Vendors still follow the same approval workflows. Authority structures don't change daily.
- Malicious intent patterns are also consistent. Social engineering still relies on urgency, authority, and fear. The intent patterns remain the same even when the attack method is completely novel.
How dual evidence collection changes everything
Dual evidence collection has become very important in this third generation: and they fundamentally change email security economics.- Traditional approach: Scan email → Find suspicious patterns → Block → Analyst investigation.
- New approach: Scan email → Collect normality evidence + threat evidence → LLM coordination → Confident automated decision.
- Public defender evidence: CFO's communication patterns, vendor's established relationship, payment within approved limits, request following documented workflows.
- Prosecutor evidence: External threat intelligence signals, communication intent analysis, authority bypass attempts, urgency manipulation patterns.
