AegisAI Perspectives · 012
AI checks the sender before delivery, scans attachments at delivery and pulls back phishing later. What to switch on in Microsoft 365 and Gmail.
AI helps at four stages of a message's life. It checks the sender before delivery, opens attachments at delivery, investigates user reports and, in Microsoft 365, pulls back phishing delivered in the last 48 hours1.
Some stages run only if their setting is on: Gmail Security Sandbox is off by default20. Automated investigation and response then queues remediation actions for security operations staff to approve4.
Three of the four stages have their own mechanism: a learned model of each user's contacts9, an attachment sandbox12 and a purge of delivered mail.
Mailbox intelligence in Microsoft Defender for Office 365 uses artificial intelligence to learn each user's email patterns with frequent contacts9. It uses those patterns to tell a real sender from an impersonated one. Each policy protects at most 350 users from impersonation, and no sender addresses are set by default.
A payment request with no link and no file gives a scanner nothing to open, so sender patterns carry the decision. The FBI's IC3 lists business email compromise losses of $3,046,598,558 for 202522. Businesses reported losses over $30 million to BEC scams involving AI in the same year. For the full detection pipeline, read how AI-powered email security analyses an email, step by step.
Safe Attachments opens attachments in a virtual environment before delivery, and Microsoft Learn says the scan completes within 15 minutes in most cases12. With Dynamic Delivery, the body arrives at once and each attachment shows as a placeholder until the scan ends. A malicious attachment sends the message to quarantine.
Gmail Security Sandbox adds an isolated attachment scan, but it is off by default and a change takes up to 24 hours to apply20.
Zero-hour auto purge (ZAP) acts on phishing, spam or malware already delivered to cloud mailboxes, and searches the last 48 hours of delivered email.
Automated investigation and response queues remediation actions for security operations staff to approve.
In Microsoft Defender for Office 365, open the default anti-phishing policy and confirm mailbox intelligence is on.
In the same policy, add the executives and finance staff to protect from impersonation, up to 350 users per policy; none are set by default.
Set the Phishing verdict action in the anti-spam policy to quarantine, so ZAP quarantines phishing found after delivery.
Turn on Safe Attachments with Dynamic Delivery, so people read the body while attachments are scanned.
Turn on Gmail Security Sandbox, which is off by default, and allow up to 24 hours for the change to apply.
Point user reported messages at a SecOps reporting mailbox, so each report reaches the team.
Review the pending remediation actions from automated investigation and response every working day.
Steps 1 to 4 and 6 to 7 apply to Microsoft 365 with Defender for Office 365. Step 5 applies to Google Workspace. For the hardening that sits around these controls, such as external sender warnings and forwarding blocks, use the Microsoft 365 and Google Workspace hardening guide.
| Stage of the message | What AI does there | Setting or report an admin uses | The limit |
|---|---|---|---|
| Before delivery | Learns each user's patterns with frequent contacts and flags impersonation | Anti-phishing policy: mailbox intelligence, impersonation protection | 350 users per policy |
| At delivery (Microsoft 365) | Opens attachments in a virtual environment before the user does | Safe Attachments policy with Dynamic Delivery | The scan completes within 15 minutes in most cases |
| At delivery (Google Workspace) | Security Sandbox scans attachments in isolation | Security Sandbox | Sandbox is off by default |
| After delivery | Moves phishing, spam or malware out of delivered mailboxes | Zero-hour auto purge | Last 48 hours only |
| When a user reports it | Proposes remediation actions | Automated investigation and response | A person approves |
Even with all 7 steps on, four decisions stay with a person, starting with mail older than the 48 hours zero-hour auto purge searches.
Mail older than the window. ZAP searches only the last 48 hours of delivered email. A message found malicious after that point needs an admin to find and remove it.
Approval of remediation. Automated investigation and response queues its actions for a person to approve. For how an agent should explain a verdict before it acts, read detect, explain, act: designing email AI agents analysts trust.
The request itself. A bank detail change sent from a real, compromised account passes sender authentication, as why DMARC-passing emails can still be phishing explains. IC3 received more than 22,000 complaints in 2025 that reported AI-related information23. Hold every payment change until a call to a number already on file confirms it.
A lab score. The ChatSpamDetector study reports 99.70% accuracy for a GPT-4 system on its own phishing dataset, a self-reported result25. That figure describes one research dataset, not your tenant's mail. Ask for results measured on your own traffic, and use what security leaders should measure with AI in email for the full metric list.
Illustrative example, figures are fictional. Larkfield Dental has 60 staff on Microsoft 365. At 09:12 a message claiming to be from its lab supplier reaches 12 mailboxes with a PDF invoice. Before delivery, mailbox intelligence sees no past mail between this sender and the office manager and flags a possible impersonation. At delivery, Dynamic Delivery shows the body at once and holds the PDF behind a placeholder for 4 minutes; the PDF is clean, and its link points to a page that is not yet malicious. At 07:40 the next day the page turns into a credential form, the URL is marked malicious, and ZAP moves 11 copies to quarantine. Nobody is notified. The twelfth recipient reported the message at 08:15, and the report went to the SecOps mailbox and started an investigation. The investigation found the URL cluster and queued its removal. It also queued a removal for a reply from the same sender. The admin approved both at 10:05.
Read quarantine inside its retention window. Messages quarantined by anti-malware policies or Safe Attachments are kept 30 days, a period admins cannot change14. Anti-spam quarantine keeps messages 15 days by default, and admins can set 1 to 30 days.
AI reads the sender and the attachment before delivery, pulls back phishing found after delivery and investigates what users report. In Microsoft 365, zero-hour auto purge covers the last 48 hours of delivered email. Remediation waits for a person to approve.
Yes. Mailbox intelligence uses artificial intelligence to learn each user's patterns with frequent contacts. Add the users to protect yourself, up to 350 users per policy.
Security Sandbox, the isolated attachment scan, is off by default.
In Microsoft 365, zero-hour auto purge does, for email delivered in the last 48 hours.
Not by default. Automated investigation and response queues its remediation actions for security operations staff to approve. Review the queue every working day.
Messages quarantined by anti-malware policies or Safe Attachments are kept for a default period that admins cannot change, then deleted. Anti-spam quarantine keeps messages 15 days by default, and admins can set 1 to 30 days.
