Weekly Security Report #5 — looking back on the first two months
We have written a report every week since the new year. Stepping back, the individual stories rhyme — and the rhyme is the real finding.
The thread through it all
Look at what the weekly reports kept describing:
- Report #1 — BEC had no payload at all; the attack was language and trust.
- Report #2 — Quishing and look-alikes hid the link from scanners and the domain from the eye.
- Report #3 — AI-written phishing erased the grammar and spelling tells we relied on for twenty years.
- Report #4 — Vendor email compromise passed every authentication check, because it was the real account.
Put together, the trajectory is unmistakable: threats keep moving away from the payload and toward the context. Less malware, fewer broken signatures, fewer obvious tells — and more attacks that are made of relationship, timing, intent, and trust.
Why this is the hard part
This is the uncomfortable conclusion of our first two months: the techniques that hurt most are the ones with the fewest matchable indicators. They are not stopped by better signatures or longer block lists. The only thing that catches them is investigation — reasoning about who, what, and why, in context — and historically that has been too slow and too scarce to apply to every message.
That scarcity is the gap attackers are standing in. It is the entire reason WhiteMail exists.
Where we go from here
Nothing in the threat landscape suggests this reverses. AI makes context-based attacks cheaper and more convincing every month, so the value of being able to investigate every email — consistently, explainably, at machine speed — only grows.
That is the work: take the depth of a senior analyst's investigation and apply it to every message, with the reasoning attached so a human can trust it in seconds. Two months in, every weekly report has pointed the same direction.
Thanks for reading along. The reports continue next week.
Try it on your own mail: paste a sample into the Analyze console, or connect a mailbox to scan an inbox in context.