Remote SupportOffence and defence: how AI is countering the threat of AI.
93% of Chief Information Security Officers expect their organisation to face daily AI-driven threats by the end of the year. 85% of security professionals attribute the recent rise in attacks to bad actors using generative AI. A third of organisations openly admit they are not equipped for it.
Here is the honest version of what AI in email security actually means, written for Australian business leaders rather than the security press.
Scale plus speed equals superior security.
Every Security Operations Centre on earth is now drowning in data. More than half a million new cyber threats are identified every single day. Within that, only around 1% of inbound traffic actually demands human intervention. The job is to find that 1% before it does damage.
No analyst, however senior, can read every log. The only honest way to do this at scale is machine learning. The point is not that ML replaces the analyst. It is that ML makes the analyst's job possible at all.
"To deal with threats effectively, a SOC needs to understand what normal looks like across millions of signals, and then surface the few that fall outside it. That is a maths problem, not a willpower problem."
Not all AI is the same. Be specific.
The word AI is used as a blanket. Nine times out of ten when a vendor uses it, they mean Generative AI, the family of models behind ChatGPT, Copilot and Gemini. That is not the same thing as Machine Learning, and it is not the same thing as a neural network.
Generative AI is good at creating text and images. Machine Learning is good at recognising patterns at scale, especially in numerical or structured data. They are different tools for different jobs.
In email security, Machine Learning is doing most of the actual defensive work. It is what powers Check Point's ThreatCloud AI, the threat intelligence repository that sits behind Harmony Email & Collaboration. ThreatCloud aggregates indicators of compromise from every participating Check Point customer, internet service providers, and national cyber security centres, then uses ML to score new traffic against that baseline in milliseconds.
Generative AI
Writes the phishing email. Used by the attacker.
Machine Learning
Reads patterns across millions of signals. Used by the defender.
Neural networks
A specific ML architecture often used for image or anomaly detection.
What ML catches that humans simply cannot.
Take a worked example, the kind we see weekly in Australian SMB inboxes.
- An email arrives, claiming to be from a supplier the finance team has paid before.
- It is opened on a mobile device using the Outlook app.
- The recipient clicks a link. The endpoint then makes a new outbound connection to a domain that did not exist 48 hours ago.
- A draft reply is started but never sent. Instead, a new mailbox rule is created that forwards finance threads to an external address.
In isolation, none of these events trip a single existing alert. A human analyst staring at four different consoles would not catch the chain in time. Machine learning, reading all four signals together against the baseline of normal behaviour in your tenant, flags it inside seconds.
That is the whole game. Scale gives you the picture. Speed gives you the response.
Run Check Point Harmony Email & Collaboration on your tenant for 30 days. On us.
We deploy Check Point Harmony Email & Collaboration alongside your existing Microsoft 365 or Google Workspace filtering, in monitor or block mode. After 30 days you keep the findings report whether you continue or not.
Start your 30 day Harmony trialWhere human judgement still wins.
ML is excellent at pattern. It is terrible at context. A bot does not know that your CFO is on leave this week. A bot does not know that the supplier in question is in dispute with your accounts team. A bot does not know that the new domain in question is, in fact, your client's recently rebranded marketing site.
A human can look at a message that technically passes every check and still say: "block this anyway, something is off." That call is irreplaceable, and it is the call our Australian engineering team is paid to make.
Machine learning gives us
Scale, speed, pattern recognition across millions of signals. The 1% surfaced from the 99%.
Humans give us
Context, judgement, accountability. The final call when the rules say one thing and reality says another.
What this means for Australian businesses.
For most Australian SMBs, three things are true at once. AI-driven phishing is now arriving daily. Microsoft 365 and Google Workspace native filtering is not the right tool for that fight. And SOC-scale machine learning has finally become commercially accessible at SMB price points.
Our recommendation is straightforward. Start with the foundations. Get DMARC to enforcement, get SPF and DKIM aligned, and shut down domain spoofing as an attack path. Then put an ML-driven Email Security Gateway in front of, and inside, your tenant to catch what the foundations cannot.
That is exactly what we do for Australian clients, end to end, on a managed service basis. The 30 day Check Point Harmony trial is the easiest way to see what it would catch in your environment, with no money at stake.
Statistics sourced from: Infosecurity Magazine (April 2024), CFO Magazine (August 2023), PR Newswire (March 2024), Twenty IT Services UK Cybercrime Statistics 2024 (July 2024). Technical analysis draws on Check Point Software Technologies' "Offence and Defence: How AI is countering the threat of AI" thought leadership paper. Check Point and Harmony Email & Collaboration are trademarks of Check Point Software Technologies Ltd.