Behavioral AI Pitched as Answer to Identity-Abuse Phishing, But Regulators Still Set the Bar

A new industry webinar argues that traditional secure email gateways can no longer catch the phishing, business email compromise, and account takeover activity now dominating enterprise inboxes. The pitch: behavioral AI, trained on identity signals and workflow patterns, can automate what human review no longer scales to.

The technical premise is straightforward. Attackers increasingly ride legitimate identities and legitimate cloud workflows. There is no malicious attachment. There is often no malicious link. What arrives looks like a real vendor asking a real accounts-payable clerk for a real thing — with the wire instructions swapped.

That matters for anyone reading the regulatory tea leaves.

BEC losses continue to lead the FBI Internet Crime Complaint Center's annual IC3 report by adjusted dollar figure, outpacing ransomware year after year. And under the SEC's final cybersecurity disclosure rule adopted in July 2023, Item 1.05 of Form 8-K requires registrants to disclose a cybersecurity incident within four business days of determining materiality. A wire fraud loss triggered by a compromised executive mailbox can meet that threshold. Several have.

Behavioral controls sit awkwardly against that timeline. If a model auto-quarantines a message that later turns out to be a legitimate CEO request, the operational cost is one thing. If it fails to quarantine an impersonation that drains a treasury account, the disclosure cost is another. Boards are starting to ask which error the vendor optimizes for.

There is also a policy tailwind. CISA's Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) notice of proposed rulemaking, published April 4, 2024, would require covered entities to report substantial cyber incidents within 72 hours and ransom payments within 24. The comment period closed July 3, 2024. The final rule is expected in late 2025, with the reporting obligations taking effect thereafter. Account takeover incidents affecting covered entities will fall inside that perimeter.

In the EU, NIS2 (Directive (EU) 2022/2555) already imposes a 24-hour early warning and a 72-hour incident notification on essential and important entities under Article 23. Member states were required to transpose by October 17, 2024, though several missed the deadline.

What a webinar cannot resolve is the evidentiary question. Behavioral models produce probabilistic verdicts. Regulators and litigants want deterministic records — who saw what, when, and what the system did. Buyers evaluating these tools should ask vendors two specific things: what the audit trail looks like for a suppressed message, and how the model's decision is preserved for a later 8-K, CIRCIA, or NIS2 filing.

The detection problem is real. The disclosure problem is the one general counsel will be reading about next.