From Signatures to Intent: Why Traditional Email Security Is Failing

[adrastosefa]

We’ve started publishing more in-depth engineering and threat-analysis content on the OpenEFA blog, focused less on product features and more on how the email threat model itself has changed.

This article was written by Mark Symmarian, one of our OpenEFA engineers, and walks through a core issue we see repeatedly in real environments: traditional, signature-based email security assumes attacker repetition—and that assumption no longer holds.

Modern attacks, especially AI-driven phishing and business email compromise, often succeed because they:

• Don’t reuse payloads

• Don’t rely on known-bad links or malware

• Adapt linguistically and contextually

• Play out as conversations, not one-off messages

The post focuses on why this breaks legacy detection models and what “intent-based detection” actually means in practice from an engineering and operational standpoint.
Read the full article

I’m interested in hearing how others here are seeing this play out:

Where do legacy gateways still hold up?
Where are you seeing clear blind spots?
Are you seeing more conversational or context-aware attacks lately?

This section is intended for open discussion and analysis, not marketing—so feel free to challenge assumptions or share what you’re seeing in your own environments.

— sb