Cyble walks through agentic AI investigation of phishing
Original title: Can Agentic AI Investigate a Phishing Campaign? Evidence Walkthrough
A Microsoft trial of 167 analysts reported large triage gains, while hidden email prompts can steer the agent.
Cyble argues an agent can enrich domains, open lures safely, pivot infrastructure, and draft a phishing verdict, but a human should approve action. It cites Microsoft’s trial of the Security Copilot Phishing Triage Agent, a Barracuda report of hidden prompts inside phishing mail, and Gartner’s cancellation forecast. The walkthrough reconstructs public lookalike Microsoft Teams domains posted by Steven Lim rather than output from one product run.
Unconfirmed: Microsoft studied its own product, and Cyble’s domain walkthrough is a reconstruction, not a recorded product investigation.
- Microsoft’s trial used 167 analysts and a 25-email queue, 20 percent malicious.
- With the agent, analysts found up to 6.5 times as many true positives per minute.
- On the test set the agent’s precision and recall were both 100 percent.
- The example seed domain was teams-online[.]com, registered October 4, 2026.
- 1.Require human approval before acting on an agent’s phishing verdict.
- 2.Treat a missing verdict on a days-old lookalike domain as incomplete evidence.
- ATT&CK
- T1566 Phishing
- Vendors
- Microsoft
From the original article
12 min read at cyble.com
Yes, with a human signing off. An agentic AI can run most of a phishing investigation on its own. It can pull domain registration records, open the lure safely, pivot to related infrastructure, extract indicators and write up a verdict with the evidence attached.
By Mihir Bagwe · cyble.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.