2
decision types: message vs. threat
4
foundations of effective phishing defense
1
richest intelligence source wasted
There is a claim doing the rounds in email security, and it is being made confidently by people who should know better: threat intelligence is old news. AI-powered behavioral detection has moved past it. You can stop worrying about who is attacking you and why, because the AI model will simply tell you which emails are bad.
It is a brilliant pitch. It removes work from the buyer, it flatters the product, and it is very difficult to argue with in a forty-minute evaluation. It is also wrong—and wrong in a way that quietly makes organizations less capable over time.
Detection and Intelligence Solve Different Problems
The core misunderstanding sits in a single swap of vocabulary. A detection verdict tells you that this email is bad. Analysis of that email derives intelligence. Intelligence tells you whether it is one email or the opening move of a campaign, whether the infrastructure behind it has touched your organization before, what the payload is actually designed to do once it lands, and what the same actor is likely to send tomorrow when the current lure stops working.
One is a decision about a message. The other is a decision about a threat.
Key distinction: Stripping the intelligence layer out and you have not simplified your security program. You have outsourced your understanding of the adversary to a vendor who has no obligation to share it with you, or who simply doesn’t care about your adversaries.
Figure 1: External intelligence VS. Internal analysis
Why This Confusion Exists
Threat intelligence has been sold badly for a decade. Plenty of organizations bought a feed, or subscribed to some sort of “open-source” intel feed, wired it into something in the SOC, and got nothing back except a larger bill and a longer list of indicators that expired before anyone looked at them.
If your entire experience of threat intel is subscribing to someone else’s IOC feeds, then hearing a vendor tell you it was never worth much may feel more like a relief than a provocation. But that argument quietly collapses two very different claims into one.
Saying that commodity indicator feeds deliver poor returns is a defensible position. Saying that understanding your adversaries delivers poor returns is an entirely different claim—and yet that is effectively what is being sold.
The Real Cost of Detection Without Intelligence
If those perimeter solutions were 100% infallible at stopping phishing threats entirely, this might perhaps not be such an issue. But they are not. Threats will still get through. Threat actors find ways around the tech and the methods in use; trusted vendor attacks and supply chain attacks demonstrate exactly that.
An effective phishing defense strategy sits on the foundation of deriving threat intelligence from the IOCs you can find in your own organization, coupled with high-fidelity, high-trust threat intel curated from threats found in other organizations. Many modern AI-powered gateway solutions don’t allow you to derive that threat intel, or provide any way to utilize what threat intel you already possess, regardless of its quality.
Your Users Are Your Most Underutilized Intelligence Asset
End-user reporting is often the last line of defense when perimeter technologies fail, and it can be wildly effective if implemented correctly. It is also the single richest source of intelligence most organizations have, and the one most consistently wasted.
The user’s job is to say “this looks wrong.” The triage layer’s job is to decide what it actually is. Press a reporting button and the report should go to your own abuse mailbox, not solely to the vendor that provided the button. That mailbox is where the intelligence you actually own starts to accumulate.
What you need alongside it is the tooling and the process to detect the real threats in what gets reported, analyze them, and derive the IOCs that let you protect the organization going forward. Because the highest-fidelity threat intelligence available to your organization is sitting in that abuse mailbox right now.
It is not generic. It is about you: the lures aimed at your finance team, the infrastructure that keeps reappearing against your domain, the payloads written to survive your controls specifically. No black-box email classifier will hand that to you as a byproduct of blocking something.
That is also why an effective phishing simulation and awareness programme trains users to spot threats so they can report them. Working to increase user reporting rates proves genuine resilience for end users and gives your SOC visibility of the threats that evaded your perimeter controls. It is the source of your own intelligence and the start of the detection process for unknown threats in your environment.
Figure 2: User-reported emails become organizational intelligence
Automation Without Intelligence Becomes Noise Amplification
This is the bridge many organisations miss. Automation is powerful—but it is only as good as the detection and analysis feeding it.
The workflow is: user reports → triage detects threat → analysis extracts behaviour and IOCs → automation acts on verified context. Remove or weaken the middle steps and automation becomes a noise amplifier, not a force multiplier.
The Microsoft Defender Example
Microsoft is worth looking at closely—partly because so many organisations run on it, and partly because it illustrates the problem clearly. Microsoft has invested heavily in automation, and great strides have genuinely been made in building process automation across the E5 security bundle.
However, Microsoft has historically struggled with the detection of phishing attacks themselves. They see the largest collection of reported emails of anyone in the industry, but haven’t been consistently excellent at creating and curating phishing threat intelligence from that data source. Microsoft Learn documents that some phishing messages can reach mailboxes despite Microsoft Defender’s anti-phishing capabilities.
That same intelligence source powers AIR and ZAP (Zero-Hour Auto Purge). Without good intelligence powering them, they are not as effective as they could be. ZAP only works on the basis of matching for known threats post-delivery, and AIR lacks the context necessary to determine the nature of the attack fully—limiting its detection efficacy.
The point is straightforward: Microsoft provides excellent end-to-end process automation, but that automation is only as good as the detection feeding it. You cannot remediate what you cannot see.
This does not mean Microsoft is something you should discount from your overall tooling stack. However, Microsoft is perhaps not the only security solution you should be considering when building your phishing defences.
Figure 3: When detection accuracy improves, automation becomes trustworthy
Building Detection That Enables Intelligence
Detection encompasses more than just a malicious verdict and blocking of a specific message. It’s the point in the process where you accurately and quickly confirm that a message is malicious and why, capture everything potentially malicious about it, then derive IOCs from that analysis and feed them into the automated processes.
At that point, that intelligence, those IOCs and those automated processes are delivering real value to defenders, to the organisation and to its users.
Automated processes coupled with poor detection methods and limited generic threat intelligence will only ever deliver a partial defence. For large or highly regulated organisations, brand damage, reputational damage and the significant financial losses associated with a breach are not risks to be taken lightly.
Remember: A malicious verdict is the alarm. Intelligence is knowing who keeps trying the door, which door they’ll try next, and what weapon they’re carrying. Teams need both—and that need doesn’t diminish as automation increases. It sharpens.
Where Superior Detection Makes the Real Difference
The analysis capabilities that matter most in modern email security are often the ones that standard gateway solutions don’t provide natively. What many organisations find they need is the deep, behaviour-focused analysis that identifies what a threat actually does—independent of how it looks.
Deep behavioral analysis provides observed execution in a controlled environment, malware behavior extraction, and the high-confidence indicators that make downstream automation trustworthy. When paired with robust automation frameworks, this creates a complete picture—the detection accuracy that feeds reliable automated response.
The combination transforms the workflow: user reports high-risk email → analysis extracts behavior and derives IOCs → automation acts on verified context → the organisation learns and prevents. Every layer works because the detection layer is honest and complete.
What Effective Phishing Defense Actually Requires
Effective phishing defense sits on four interconnected foundations: known threats through perimeter technology, unknown threats through behavioral analysis, human awareness and reporting, and rapid detection coupled with actionable intelligence. These foundations are derived from actionable threat intelligence—both intelligence you generate internally from your own environment and verified external threat intelligence about the threats targeting your sector.
Figure 4: All four layers working together powered by actionable threat intelligence
Detect Phishing Threats by What They Do, Not Just What They Look Like
Signature-based detection alone can’t keep pace with phishing and other modern threats. Build a detection program powered by high-fidelity behavioral analysis and actionable threat intelligence — with automated response you can trust.
Frequently Asked Questions
Is threat intelligence still useful for phishing detection?
Yes. Detection establishes whether a message is malicious; threat intelligence helps connect that event to infrastructure, behaviors, campaigns and related indicators. Both are necessary for a complete phishing defense.
How does phishing detection generate threat intelligence?
Through analysis of URLs, attachments, infrastructure, behavior and extracted indicators associated with malicious messages. This turns a single detection into organizational learning, providing high-fidelity signals specific to your environment.
Why analyze user-reported phishing emails?
Because reported messages often include threats that bypassed preventive controls and provide organization-specific evidence about active targeting. These are your highest-value intelligence signals—the lures, infrastructure, and payloads attackers are using against you specifically.
Does Microsoft Defender detect all phishing emails?
No security technology provides perfect detection. Microsoft itself documents investigation procedures for phishing messages that reach inboxes despite protections. This is why layered detection and behavioral analysis matter.
How does deep behavioral analysis complement security automation?
It provides the high-confidence detection verdicts and IOCs that make automated response reliable. Automation without accurate detection creates noise and false positives; automation with precise detection creates signal and effective response.
Author – Meet the Expert
James Hickey
Chartered IT Professional (CITP) | Senior Security Solution Engineer
Expertise: Phishing defense, behavioral malware detection, automated SOC workflows, threat intelligence integration, and enterprise security architecture.
