AI & AI-Era Business

The Surge in Suspicious Emails Is Just the Tip of the Iceberg

Adair Taulbee · October 14, 2026 · 3 min read

How agentic AI is changing the speed, scale, and sophistication of cybercrime—and why businesses need to prepare for what comes next.

In short: Suspicious email is surging, but the larger risk is agentic AI automating how attacks are researched, personalized and adapted, so businesses that rely on people to notice, report, investigate and escalate need to confirm who monitors alerts after hours, how fast they respond, and when their incident response process was last tested.

Slide 1 of 8: We're seeing the tip of the iceberg. Agentic cybercrime. The suspicious emails hitting your inbox now are just the visible part of a much bigger threat. What you see: phishing emails, suspicious calendar invites, impersonation attempts, fraudulent invoices. What's below the surface: AI agents researching your business, identifying employees and relationships, automating personalized attacks at scale, testing and adapting tactics in real time, targeting more businesses faster and more continuously. Slide 2 of 8: The rise is showing up in the research. About 24%: Check Point, phishing prevalence, August to September. 46%: Proofpoint, detected email threats, year over year. 1,000%+: Sublime, calendar phishing surge. 1 million+: Microsoft, fraudulent emails in one campaign. Slide 3 of 8: The old model. Attacks required more hands-on work: 1. Research the target. 2. Write the message. 3. Send the campaign. 4. Review what worked. 5. Adjust and repeat. Slide 4 of 8: The agentic model. The workflow itself becomes automated: research, personalize, execute, evaluate, adapt. And repeat, at scale. Slide 5 of 8: The economics. More attacks, less manual effort. Faster: research and execution. Cheaper: lower operating effort. Broader: more targets at once. Adaptive: tactics change with results. Slide 6 of 8: The dangerous mismatch. Machine-speed attacks, human-speed response. Attack: automated reconnaissance, execution, adaptation. Response: notice, report, investigate, escalate, act. The gap is where damage grows. Slide 7 of 8: The business impact. The consequences go well beyond the inbox: fraudulent payments, stolen credentials, exposed customer data, interrupted operations. Slide 8 of 8: Are your defenses built for what comes next? Who sees the alert? Who responds, and how quickly? What happens after hours? Cybersecurity readiness is a business issue.

Swipe through the 8-slide version. The full written version is below.

Have you been getting a lot more suspicious emails lately?

It’s not just you. I’ve been seeing it firsthand, and I’ve asked around. Other technology and cybersecurity professionals are seeing the same thing.

So I went looking for evidence. And the research backs it up.

But the increase in malicious emails isn’t what concerns me most. I believe we’re only seeing the tip of the iceberg.

Is the surge in suspicious emails real?

Several recent cybersecurity reports caught my attention:

  • Check Point: Phishing email prevalence increased approximately 24% between August and September 2026. In North America, one in every 79 emails was classified as phishing.
  • Proofpoint: Detected email threats increased 46% year over year, from 4.4 billion to 6.4 billion.
  • Sublime Security: Calendar-based phishing attacks surged more than 1,000%.
  • Microsoft: A single executive-impersonation campaign involved more than one million fraudulent emails.

These findings come from different datasets and measurement periods, but together they illustrate the scale and variety of threats organizations are facing.

Is this just more phishing, or something bigger?

We’ve already seen what generative AI can do for cybercriminals. Convincing emails, impersonation, and personalized messages are easier to create than ever.

But agentic AI takes things considerably further. AI agents can execute sequences of tasks, use tools, evaluate results, and adapt their approach.

Now consider what that means for cybercrime. Researching an organization. Identifying employees and relationships. Developing personalized attacks. Executing campaigns. Evaluating responses. Adjusting tactics.

Work that once required substantial human effort can increasingly be automated. This changes the economics of cybercrime. Sophisticated attacks become faster, cheaper, and easier to execute at scale.

Why are human-speed defenses a problem?

Here’s what concerns me from an operational perspective. Many businesses still depend on cybersecurity processes that require someone to notice suspicious activity, report it, investigate it, escalate it, and decide what to do.

Meanwhile, attackers are gaining the ability to automate more of their operations. That’s a dangerous mismatch.

And it matters particularly for small and midsize businesses that don’t have dedicated security teams watching their environments around the clock.

What five questions should I ask my cybersecurity provider?

You don’t need to understand every technical aspect of cybersecurity to understand whether your business is prepared. But you should know the answers to these questions:

  1. Who monitors our security alerts, including after business hours?
  2. How quickly are suspicious activities investigated?
  3. Who is responsible for responding and escalating incidents?
  4. Can compromised accounts or devices be contained immediately?
  5. When was our incident response process last tested?

These aren’t simply IT questions. They’re questions about financial exposure, operational continuity, customer trust, and business risk.

And having security software installed isn’t the same as having an effective security response.

What happens next?

To be clear, the recent increase in phishing doesn’t establish that autonomous AI agents are responsible for it. My concern is what happens next.

We’re already dealing with substantial malicious activity while AI is making increasingly sophisticated attacks easier to automate.

Businesses are understandably excited about what AI can do for productivity, efficiency, and growth. But we need to recognize that criminals are exploring those same capabilities.

The question isn’t just whether your business is receiving more suspicious emails. It’s whether your defenses are prepared for what comes next.

The takeaways, in short

  • Suspicious email is surging across multiple independent reports, including Check Point, Proofpoint, Sublime Security and Microsoft
  • The bigger concern is agentic AI automating research, personalization, execution and adaptation, which makes sophisticated attacks faster, cheaper and easier to run at scale
  • Defenses that depend on people noticing, reporting, investigating and escalating can’t keep pace with machine-speed attacks
  • The gap is hardest on small and midsize businesses without security teams watching around the clock
  • Ask your provider who monitors alerts after hours, how fast they investigate, who responds, whether compromised accounts can be contained immediately, and when the response process was last tested
  • Having security software installed isn’t the same as having an effective security response

Questions we hear about this.

Does the rise in phishing mean AI agents are behind it?

Not necessarily. The recent increase in phishing doesn’t establish that autonomous AI agents are responsible for it. The concern is what happens next: businesses are already dealing with substantial malicious activity while AI makes increasingly sophisticated attacks easier to automate.

How is agentic AI different from generative AI for cybercriminals?

Generative AI makes convincing emails, impersonation and personalized messages easier to create. Agentic AI goes further: AI agents can execute sequences of tasks, use tools, evaluate results and adapt their approach, which means researching an organization, identifying employees and relationships, developing personalized attacks, executing campaigns, evaluating responses and adjusting tactics can increasingly be automated.

What should my business ask its cybersecurity provider?

Five questions: Who monitors our security alerts, including after business hours? How quickly are suspicious activities investigated? Who is responsible for responding and escalating incidents? Can compromised accounts or devices be contained immediately? When was our incident response process last tested? Having security software installed isn’t the same as having an effective security response.

The question isn’t just whether your business is receiving more suspicious emails. It’s whether your defenses are prepared for what comes next.

Sources and further reading: Check Point findings (IT Brief, October 2026) · Proofpoint: Modern Email Security · Sublime Security: Calendar-Based Phishing · Microsoft Security: Executive Impersonation Campaign

Related: I followed up on the defensive side in Everybody Gets Defensive AI. And I Mean It.

Adapted from my Practical AI for Business newsletter on Substack.

Not sure who’s watching your alerts?

If you can’t answer these questions about your own business yet, that’s worth a conversation. For managed IT and cybersecurity support, our sister company, Signal Point Cyber Co, handles infrastructure, security, and ongoing IT support for North Texas service businesses.

Tell Me What’s Going On Visit Signal Point Cyber Co →