RemoteAI email security
AI writes better phishing than most people write email. Filters and process have to keep up.
The spelling mistakes are gone. AI-written messages use the right names, the right projects and the right tone, and some carry no link at all. Machine learning filtering catches a lot of it. The rest is stopped by process. Here is how the layers fit, and a map of which attacks your current defences cover.
Claims data from Coalition; Microsoft licensing from Microsoft Learn. Checked 31 October 2026.
- How AI phishing works
- What filters catch
- Coverage map
Reviewed by Blake Bath, General Manager, on 31 October 2026.
What we see
Four kinds of AI-assisted email attack.
Each needs a different layer to stop it.
Credential phishing
A polished message with a link to a fake sign-in page.
- Link checking
- Phishing-resistant MFA
- Report button
Impersonation
A lookalike domain or display name posing as a leader or supplier.
- Impersonation rules
- External tags
- DMARC
Compromised supplier
A real supplier's mailbox, used to send a fake invoice or bank change.
- Behaviour analysis
- Phone check
- Two approvers
Malicious attachments
Documents that run code or lead to a download.
- Sandboxing
- Macro blocking
- EDR
Email defence coverage map
Which email attacks do your defences actually cover?
Tick the layers you have. You see which attack types each helps with and the gaps, in the order we would close them.
Tick the layers you have today. You see which email attacks each one helps with, and where you are exposed.
Your coverage
2 of 7 attack types
- Covered: Someone sending as your own domain
- Gap: Lookalike domains and display-name tricks
- Gap: Links to fake sign-in pages
- Covered: Malicious attachments
- Gap: A real supplier's mailbox, compromised
- Gap: A clean, AI-written payment request with no link
- Gap: An attacker already inside a mailbox
Next, in order
- Phone verification on every bank detail change. Free, and it stops the attacks filters miss.
- Add a filtering layer that rewrites links and checks attachments and impersonation: Defender for Office 365 or a dedicated email security product.
- Phishing-resistant MFA, so a stolen password from a fake page isn't enough.
- Alerts on new forwarding and delete rules, acted on quickly.
- A report button, and a fast answer when staff use it.
Covered means at least one layer helps. No single layer stops everything.
Be specific
Not all AI is the same.
- Generative AIWrites the message. Used by attackers to produce convincing text at scale.
- Machine learningReads patterns across huge volumes of mail. Used by defenders to score new messages.
- PeopleBring context: who is on leave, which supplier is in dispute, what just feels wrong.
Defence in depth
The layers, and what each one does.
| Layer | What it does | Where it comes from |
|---|---|---|
| DMARC at reject | Stops others sending as your domain | DNS settings, any plan |
| Built-in filtering | Spam, known malware, bulk mail | All Microsoft 365 and Google plans |
| Defender for Office 365 Plan 1 | Link and attachment checking, impersonation protection | Business Premium; Microsoft 365 E3 from 1 July 2026 |
| Dedicated email security layer | Extra analysis, including compromised supplier mail | Separate product, such as Check Point Harmony Email & Collaboration |
| Phishing-resistant MFA | Makes a stolen password from a fake page useless | Entra ID and passkeys |
| Process | Phone checks on bank changes, two approvers | Your procedures |
How it chains
A typical attack, step by step.
- 1. A message from a known supplierOpened on a phone, between meetings.
- 2. A link to a sign-in pageOn a domain registered days ago.
- 3. A mailbox rule appearsForwarding finance threads to an outside address.
- 4. A bank change request followsWeeks later, perfectly written, in the real thread.
Each step on its own looks ordinary. Filtering, MFA, mailbox rule alerts and a phone check each break the chain at a different point.
Our view
Buy filtering for volume. Rely on process for money.
Good filtering removes most of the noise, and machine learning is what makes that possible at scale. But the most expensive emails we see are the clean ones: a real supplier's account, a normal-looking thread, a new bank account.
So we set up the layers in order: DMARC, phishing-resistant MFA, Defender presets or a dedicated layer, mailbox rule alerts, and a phone check on every bank detail change. That last one costs nothing.
The order
Strengthening email defence in five steps.
- Step 1DMARC to reject
No one sends as you.
- Step 2Phishing-resistant MFA
Stolen passwords stop working.
- Step 3Filtering presets
Defender for Office or a dedicated layer.
- Step 4Alerts and reporting
Mailbox rules watched, report button used.
- Step 5Payment process
Phone checks and two approvers.
Related guides
Email security in depth. Filters, sign-in and process.
The controls around the inbox.
Get help your way
Six ways to reach us. Pick whichever suits you.
Helpdesk hours are Monday to Friday, 8am to 5pm AEST. On Advantage and above, emergencies get a response within 1 hour and outages within 2, with 24/7 best-effort escalation.
- Call 07 3114 2808
An engineer answers Monday to Friday, 8am to 5pm AEST. After hours, weekends and public holidays, Chip, our AI agent, answers on the same number or on 07 3180 0965, logs it and escalates urgent incidents to the on-call engineer.
Call now - Email the helpdesk
Send it to helpdesk@realbytes.com.au and a ticket is logged straight away, with a reference number you can quote.
Email us - Client portal
Log and follow your tickets, see what we are working on and who has it.
Open the portal - Remote support
When an engineer asks to see your screen, start a secure session here. You start it, so nobody sees your screen until you do.
Start a session - Chat in Microsoft Teams
Clients can message Chip, our AI assistant, in Teams to log a request without leaving their desk.
How clients reach us - Service status
Check whether Microsoft 365 or another cloud service is down before you lose an hour troubleshooting.
See live status
Questions
What people ask about AI and email security.
How does AI change phishing?
It removes the old warning signs. Messages are well written, use the right names and projects, and can be produced in volume and tailored to each target. Some carry no link or attachment at all, just a convincing request.
What is the difference between generative AI and machine learning in email security?
Generative AI writes text and images, and attackers use it to write phishing. Machine learning spots patterns across huge numbers of messages, and defenders use it to score new mail against what normal looks like.
Is Microsoft 365's built-in filtering enough?
Basic filtering handles spam and known malware well. Defender for Office 365, in Business Premium and in Microsoft 365 E3 from 1 July 2026, adds link and attachment checking and impersonation protection. A dedicated email security layer adds more, especially for compromised supplier mailboxes. What you need depends on your risk.
Can a filter stop a clean AI-written payment request?
Not reliably. A message with no link, from a real but compromised supplier, may look completely normal. That is why phone verification of bank detail changes is the control that matters most.
Can AI replace the people reviewing email threats?
No. Machine learning is good at pattern and poor at context. It doesn't know your CFO is on leave or that a supplier has just changed banks. People still make the final call on the odd ones.
Where should a small business start?
DMARC at reject, phishing-resistant MFA, Defender for Office 365 preset policies if you have them, a report button staff actually use, and a phone check on every bank detail change. Then consider a dedicated email security layer.
Next step
Want to know what's getting through?
We review your filtering, DMARC, sign-in and payment process, and show you which attacks your current setup would miss.
Keep reading
Reviewed by Blake Bath, General Manager, on 31 October 2026. Claims data from Coalition; Microsoft licensing from Microsoft Learn. Check Point and Harmony Email & Collaboration are trademarks of Check Point Software Technologies Ltd. Checked 31 October 2026. Coalition, 2025 Cyber Claims Report; Microsoft Learn, Defender for Office 365 service description; ASD, Protecting against business email compromise