Interview with Alan Lefort from StrongestLayer

1. AI introduced sophistication into phishing tactics- especially moving beyond the “password.” Now all the attacks, albeit conducted by the same malicious actors, look different with no shared indicators. As a security leader with over 20+ years of experience, is there a glaring sign of phishing that organizations are missing out on- or is it all just more of the same?

I think the glaring “reality” is that advanced attacks that succeed look frighteningly normal today. That’s a shift from 10 years ago, when you could spot deviations from normal and assume they were risky. Not true today. Rare does not equal risky. And advanced attacks are indistinguishable from normal, especially when they come from compromised trusted sources.

2. Threat vectors in 2026 fundamentally leverage legitimate infrastructure. Language quality is no longer a reliable trust signal of phishing. In an atmosphere where even the slightest use of convincing language can end up sounding distrustful or sweet-talking, how can security leaders establish a defensible posture?

The mimicry AI performs is a double threat to security leaders. Attacks are harder to detect, but they are also easier to misclassify (false positives). So leaders face a false trade-off: minimize missed attacks, but greatly increase operational burden with false positives. Security leaders need a defense posture that is not based on known patterns, but rather intent. If AI empowers attackers to make every attack practically unique, you need a defense posture that can stop attacks it has never seen before. A posture that can understand the intent and context of an email, in real time.

3. Modern-day malicious actors bypass payload filters by weaponizing legitimate infrastructure- real SendGrid accounts, Cloudflare captchas, and Google redirects. In your opinion, which facets do existing, and not just legacy, defense structures lack in facing such sophisticated incidents?

The biggest gap in traditional tools is the architecture itself. If you are an inline gateway designed to inspect and let emails through in hundreds of milliseconds, there is a limit to how much investigation you can do. With an API-based solution, you have more time to investigate, so you can do deep evidence collection and investigation in context. For example, say you have to follow a link in the email. You can follow it to the next link, analyze the page, then go to the next link, which could be a captcha. Once that’s solved, it reveals a page with a hidden proxy to steal credentials or tokens. That can’t be done in under a second. And of course the user never sees the email until the investigation is complete. That’s just one example of many.

4. In a 2026 NIST-discussed research study, cybersecurity experts weighed in on the fact that phishing training programs rarely instill lasting change. The same report also spotlights employees as potential cybersecurity sensors. To cultivate a healthy employee model around this, in what ways must leadership equip themselves and the larger organization so that employees are able to grasp the critical nature of this role and fulfill it effectively?

There is a lot of debate on security awareness, its usefulness, and how it should evolve. I think the advent of the AI-enabled attacker forces us to confront some truths. For example, if we believe it will take an AI to defend against an AI, and that defensive AI is operated by security experts with decades of cumulative experience, do we really expect a non-technical employee with two hours of cybersecurity training a year to catch what the AI and the experts did not? It seems illogical and improbable.

What if we could flip the model? Let’s not ask employees to learn security skills to protect the org, but rather use their current strengths to make the system stronger. What if employees contribute context about the business? Is this a real supplier? Is this a valid project? Is this your policy for approving vendor payment changes? Answers to those questions help find those exceedingly normal-looking attacks. And unlike reporting a “phish,” which helps block a future attack or two, the right context could prevent thousands of future attacks. So not only are they truly helping the organization, they are doing so strategically.

5. Traditional email security systems merely focus on reasons why an email is suspicious. However, the absence of such indicators doesn’t ultimately signify legitimacy. How can leaders rethink this limitation into a business advantage? What do you believe is the underlying predicament security leaders might be overlooking?

Detection has shifted from “finding the smoking gun” to assessing a messy pile of conflicting, circumstantial evidence. Indicators of compromise are the smoking guns: links and attachments. Business email compromise attacks are hard precisely because they lack obvious ways to leverage rules and reputation to block them.

For example, let’s say a bad actor compromises one of your vendors. They learn the vendor’s communication patterns: timing, tone, topics. Then they issue an invoice with the bank account details changed. They know everything about the vendor. But they don’t know your internal processes. So they ask to make the change via email, when your policy is to verify those changes by phone. A system with your organizational context would flag this as dangerous, while a system without it would not.

In a world where hackers have the strongest AI available to them, and so do you for defense, the difference is data. If hackers have to guess what happens in your org while you have access to facts from your systems of record and your people, then you win. Facts > guesses.

6. For high-value business email compromise, email telemetry is no longer enough. Detection quality today relies on reasoning, intent, and context. As the co-founder and CEO of StrongestLayer, can you walk our readers through the structural and design imperatives of a defense system designed for AI-age attacks, especially in the context of what you’ve envisioned at StrongestLayer?

A system designed for the AI age should have one main organizing principle:

It must be designed to catch attacks it has never seen before.

To do this, it must be able to ask itself, on every email it sees:

What is it trying to accomplish? (Intent)

Is it using evasive techniques to defeat defensive technologies? (Evasion)

How is it personalizing the attack with knowledge about the person, the role, and the company to earn the click? (Personalization)

Then, when the defense system detects an attack, it has to assess it in context. An exec impersonation attack stops being one when you know the gmail account is the exec’s personal email and not a spoofed one.