AI-Powered Email Threats: The MSP’s 5-Step Action Plan
Managed services providers (MSPs) are on the front lines, defending clients from a constant barrage of email-based attacks. They’ve become experts at deploying filters, training users and spotting the classic red flags.
But the game has fundamentally changed.
Generative AI has emerged as a powerful new weapon for cybercriminals. The same large language models (LLMs) that businesses are using for productivity are now being used to create attacks at unprecedented scale. According to the World Economic Forum’s Global Cybersecurity Outlook 2025, nearly 47% of organizations cited adversarial advances powered by generative AI (GenAI) as their primary concern.
For MSPs, this new era of AI-driven threats means legacy tools are no longer enough. It demands a fundamental shift in your security stack and client strategy.
The new wave: how AI is arming attackers
We are no longer fighting simple spam and obvious phishing. We are fighting AI models that learn, adapt and mimic human behavior with unprecedented accuracy. Here’s what MSPs need to prepare their clients for.
1. AI-powered phishing at scale
Forget the poorly spelled emails with suspicious links. Generative AI can craft highly personalized, flawless phishing emails. It can scrape a target’s LinkedIn profile, understand their role, reference recent company news, and create a contextually relevant, urgent request. This personalization, which once required attackers to spend hours researching, can now be accomplished in seconds at scale.
2. Hyper-realistic business email compromise (BEC)
BEC attacks have always been damaging, but AI adds a dangerous new layer of authenticity. AI models can be trained on an executive’s publicly available interviews or analyze their leaked email history to perfectly mimic their communication style, tone and common requests. This isn’t just spoofing a name; it’s cloning a digital personality to make fraudulent wire transfer requests or data exfiltration commands that are nearly impossible for a busy employee to distinguish from the real thing. This automation is a key driver behind the staggering $2.77 billion in BEC losses reported by U.S. businesses and individuals to the FBI’s Internet Crime Complaint Center (IC3) in 2024.
3. The multichannel onslaught
Attackers know that trust is built across multiple platforms. AI is now being used to orchestrate complex attacks that span email, SMS and collaboration tools like Slack or Teams. An employee might receive a legitimate-looking email, followed moments later by a text or Teams message from a “colleague” referencing that email. This multipronged approach breaks down an employee’s natural suspicion and has proven incredibly effective. Voice phishing, or “vishing” attacks, increased by 442% in 2024 and the Anti-Phishing Working Group (APWG) identified QR code phishing (i.e., “quishing”) as a significant emerging threat in its Q1 2025 Phishing Activity Trends Report.
4. The “invisible” payloadless attack
Legacy email gateways are trained to find one thing: a malicious payload, such as a bad link or a malware-infected attachment. So, attackers are simply removing them. AI excels at crafting “payloadless” attacks that rely solely on social engineering. These emails don’t contain anything for a traditional filter to block. Instead, they use urgent, convincing language to trick a victim into wiring money, changing payroll details or logging into a fake portal to “verify” their credentials.
Why legacy defenses are failing
This emerging generation of AI-based threats differs significantly from traditional threats as they do not display the usual warning signs. AI models circumvent signature-based detection methods and reputation filters by frequently originating from legitimate accounts that have been compromised. They also adapt their tactics in real-time based on operational effectiveness, enabling the deployment of mass-customized attacks at a pace surpassing that of any human-led security team.
The MSP’s email security playbook for an AI-driven world
For MSPs, this isn’t just a threat; it’s a mandate to evolve. Your clients rely on you to stay ahead of the curve. Here are five critical mitigation strategies to build into your service offerings.
1. Fight AI with AI
You can no longer bring a knife to a gunfight. The only effective counter to an AI-driven attack is an AI-driven defense. MSPs must leverage modern security platforms that use machine learning and AI to analyze communication patterns, detect behavioral anomalies and understand context. These systems can identify that an email style is correct, but the request is anomalous (e.g., the CEO never asks for gift cards), something a legacy filter would miss.
2. Harden the perimeter with layered security
A single barrier is useless. Your standard stack for every client must include multi-factor authentication (MFA) as a non-negotiable baseline. Enforce sender authentication protocols (DMARC, DKIM and SPF) to block basic spoofing and deploy anomaly-detection tools to identify unusual login attempts or impossible travel scenarios.
3. Evolve user awareness training
The “human firewall” is more critical than ever, but the training must change. MSPs should provide continuous training services for their clients, not just a once-a-year webinar. This training must focus on these new, sophisticated tactics: recognizing the urgency of a “payloadless” request, verifying wire transfers via a separate, known channel (such as a phone call) and treating internal requests with the same level of suspicion as external ones.
4. Implement zero trust principles
The old “trust but verify” model is dead. The new model for MSPs must be “never trust, always verify.” Champion a zero-trust architecture for your clients. This means applying least-privilege access so that even if an account is compromised, the attacker has limited access. It also means verifying all communications, even those that appear to be internal, before acting on them.
5. Double down on monitoring and response
Assume a breach will happen. The deciding factor is how fast you can respond. MSPs must have 24/7/365 monitoring and rapid response capabilities. Whether you build your own Security Operations Center (SOC) or partner with a managed detection and response (MDR) provider, continuous monitoring of email, endpoint and network traffic is essential to catch and contain threats before they escalate.
The MSP’s new mandate
Generative AI has democratized cybercrime, providing low-level attackers with sophisticated tools that were previously available only to nation-states. As trusted IT and security advisors, MSPs are the last line of defense for thousands of businesses. Protecting your clients – and your own practice – means embracing this new reality, decommissioning outdated tools and adopting an intelligent, multi-layered security posture built for the AI era.
Geoff Thompson
Geoff Thompson currently serves as the Vice President of Managed Services Strategy and Development at Barracuda. He has a distinguished record of leading high-performing teams, optimizing recurring revenue models, and transforming go-to-market strategies within the IaaS and cybersecurity channel ecosystem. Prior to joining Barracuda, Thompson spent over 17 years at VMware, where he held several sales and leadership roles, including Vice President of VMware Cloud Provider Sales.