AI Phishing Response Time: Why Pre-Delivery Detection Wins
AI phishing can reach a new organization every 12 seconds. See why post-delivery response starts too late and what pre-delivery detection changes in practice.
.png){kind=logo}
AI-generated phishing campaigns can reach a new organization every 12 seconds and turn a single victim into a new sender in under 19 minutes, according to AegisAI's Q3 2026 State of the AI Attack report. At that pace, any defense that acts after delivery (a user report, a SOC ticket, a retroactive sweep) starts the race already behind.
Source: AegisAI, State of the AI Attack, Q3 2026.
Key takeaways
- AegisAI threat research tracked campaigns spreading from one organization to the next in as little as 12 seconds.
- Post-delivery controls depend on human reporting or SOC triage, both of which run at human speed, not machine speed.
- Proteus, AegisAI's detection model, identified more than 99% of attacks in a 3,020-message human-reviewed benchmark, compared to 81.3% for a leading general-purpose model, and returned verdicts 7.2x faster.
- Pre-delivery architecture means a verdict is rendered before a message or calendar invite reaches a person, not after.
- Evaluating email security vendors now requires asking about verdict latency and architecture, not just detection accuracy.
How fast does AI phishing actually spread?
AI has changed phishing from a slow, manual campaign into something closer to automated propagation. AegisAI's threat research tracked three named campaigns and measured how quickly each one moved once it started.
| Campaign | Spread behavior | Time |
|---|---|---|
| FILLTHEBILL | Reached a new organization | Every 12 seconds |
| REDTIDE | Turned a victim into its next sender | Under 19 minutes |
| CAPTCHATHEBILL | Reached nearly a quarter of protected organizations | 88 minutes |
Source: AegisAI, State of the AI Attack, Q3 2026.
This matches a broader pattern researchers are seeing across e-crime generally. According to Cybersecurity Dive's reporting on breakout speeds, the average e-crime breakout time reached 29 minutes in 2025, a 65% increase in speed from the prior year. Attackers across categories, not just phishing, are compressing the time between initial access and lateral movement.
For a deeper look at how one of these campaigns operated, see AegisAI's breakdown of the calendar invite worm that spread mailbox to mailbox. The other two are covered in what AI Dragnet phishing is and why CAPTCHA and cloaked pages defeat link scanners.
Why does this speed matter more than the message content?
Traditional phishing defense assumes a window exists between delivery and harm: time for a user to notice something is off, time for a SOC analyst to review a report, time for a retroactive sweep to catch what slipped through. AI-generated campaigns compress that window to seconds or minutes. A defense built around a window that no longer exists will always be working from behind.
Why does post-delivery response fail at this speed?
Most email security still depends on one of three mechanisms, all of which happen after a message has already landed in the inbox:
- User reporting. A recipient notices something suspicious and flags it.
- SOC triage. An analyst reviews the flagged message, gathers evidence, and issues a verdict.
- Retroactive remediation. A sweep removes the message from other inboxes once it is confirmed malicious.
Each step adds time, and AI phishing campaigns are often finished spreading before any of them complete.
How long does human reporting actually take?
A human reporting loop depends on someone noticing the message, deciding it looks wrong and clicking report, and then on someone else reading that report. Even a fast reporter cannot consistently outrun a campaign like FILLTHEBILL, which can reach a new organization every 12 seconds, across an entire organization.
What happens to the SOC after a report comes in?
The problem compounds once a report reaches the security operations center. According to The Hacker News' reporting on SOC alert volume, AI-generated phishing has driven a volume of ambiguous, hard-to-close alerts that overwhelm Tier 1 analysts, who often lack the evidence to issue a confident verdict and escalate to Tier 2 instead. Every escalation adds delay exactly when speed matters most.
Getting faster at responding after delivery is not the same as stopping the attack before it lands.
Post-delivery vs. pre-delivery: a quick comparison
| Post-delivery response | Pre-delivery detection | |
|---|---|---|
| When the verdict occurs | After the message reaches the inbox | Before the message reaches a person |
| Depends on | User report or SOC review | Automated evidence evaluation |
| Exposure during the gap | Every recipient who opens it before detection | None, if the verdict blocks delivery |
What does pre-delivery mean in email security architecture?
Pre-delivery is an architecture decision, not a feature toggle. It means the system evaluates a message or calendar invite and renders a verdict before it reaches a person, rather than scanning it after the fact or waiting for someone to flag it.
This distinction matters because detection, however accurate, that arrives after delivery arrives too late to prevent the first click. AegisAI has written about this gap in more detail in why half of AI phishing still reaches the inbox.
Inline, pre-delivery systems evaluate structured evidence (headers, sender history, link destinations, calendar metadata) before the message is released to the recipient. For a full architectural breakdown, see AegisAI's guide to inbound email security. The same logic applies to trust hijacking, covered in why DMARC-passing emails can still be phishing.
How does Proteus evaluate email before delivery?
AegisAI's detection model, Proteus, is built to issue a verdict within the delivery window rather than after it. On a benchmark of 3,020 human-reviewed phishing attacks, Proteus identified more than 99% of them, compared to 81.3% for the leading general-purpose model, and returned its median verdict 7.2 times faster, according to AegisAI's benchmark described in the Proteus model announcement.
Source: AegisAI, Proteus model announcement, benchmark of 3,020 human-reviewed attacks.
What makes a single forward pass different from iterative analysis?
Rather than relying on an iterative, chain-of-thought process to reach a verdict, Proteus is designed to evaluate structured email evidence in a single forward pass. This reduces the compute and time needed per message, which is part of why verdicts return faster without sacrificing accuracy. More on the mechanics of this evaluation is covered in AegisAI's explainer on how AI-powered email security works.
What is agentic investigation, and when is it used?
Not every message resolves cleanly in a single pass. For ambiguous cases, AegisAI applies agentic investigation: an automated process that pursues message-specific evidence (checking a sender's domain history, resolving a redirect chain, correlating against known campaign infrastructure) before the message is released. This happens inline, before delivery, rather than as a post-incident forensic exercise. AegisAI's breakdown of the anatomy of an AI phishing attack walks through the kind of evidence this investigation looks for.
What should security teams evaluate when choosing a pre-delivery solution?
When comparing vendors, speed and accuracy both need verification, not just marketing claims. Questions worth asking:
- What is the median time between message arrival and verdict, and is that verdict rendered before or after delivery?
- What detection rate does the vendor report on an independent or human-reviewed benchmark, and how large is that benchmark?
- Does the system cover calendar invites and non-email vectors, given how campaigns like REDTIDE have used calendar mechanics to spread?
- Does the architecture sit inline in the mail flow, or does it depend on user reporting or retroactive sweeps?
- How does the vendor handle ambiguous messages that do not resolve on the first pass?
AegisAI's guide on how to evaluate email security vendors goes deeper into these criteria. For a technical look at calendar-based attacks specifically, see calendar phishing remediation and how to protect Google Workspace from calendar invite phishing.
FAQ
What is AI phishing response time?
AI phishing response time refers to how quickly a defense system or security team can detect and act on an AI-generated phishing message. AegisAI's research found that campaigns can spread to a new organization every 12 seconds, which means response measured in minutes is often too slow.
Why is post-delivery remediation insufficient against AI phishing?
Post-delivery remediation depends on a message already reaching the inbox, then being reported or detected, then being removed. Human reporting takes time, and SOC escalation adds further delay, according to The Hacker News' reporting on Tier 1 alert overload. AI campaigns can finish spreading before these steps complete.
What is Proteus and how is it different from a general-purpose AI model?
Proteus is AegisAI's detection model, built to evaluate structured email evidence in a single forward pass. On a 3,020-message benchmark, it identified more than 99% of attacks compared to 81.3% for a leading general-purpose model, with a 7.2x faster median verdict, according to AegisAI's benchmark data.
How fast can AI-generated phishing campaigns spread across an organization?
Spread rates vary by campaign. AegisAI tracked one campaign reaching a new organization every 12 seconds, another turning a victim into a new sender in under 19 minutes, and a third reaching nearly a quarter of protected organizations in 88 minutes.
Does pre-delivery detection stop every phishing attack?
No detection system stops every attack. Pre-delivery architecture reduces the exposure window by issuing a verdict before delivery rather than after, which matters most against fast-spreading, automated campaigns where post-delivery response structurally cannot keep up.
Next step
Post-delivery response was built for a slower era of phishing. If your current email security depends on user reports or SOC triage to catch AI-generated attacks, it is worth seeing what pre-delivery detection looks like in practice. Book a demo with AegisAI to see Proteus evaluate live phishing samples before delivery.
Related posts
More from the AegisAI blog.