--- title: "Watch on demand: What should your SecOps team do when AI-generated phishing gets past the filters? | OneAxiom" description: "Watch the OneAxiom and IRONSCALES roundtable on AI-generated phishing: how AI is changing email attacks, what containment covers after a click, and where automation stops. Free recording and slides." --- [Skip to the recording](https://security.oneaxiom.com/ai-generated-phishing-roundtable-typ#watch) [![OneAxiom](https://security.oneaxiom.com/logo-oneaxiom.svg)](https://oneaxiom.com) Now on demand [Book a free 1:1](https://meetings-na2.hubspot.com/andie-prandini/intro?utm_source=hubspot&utm_medium=direct&utm_campaign=webinar-october-2026&utm_content=typ) On-demand roundtable # What should your SecOps team do when AI-generated phishing gets past the filters? OneAxiom's SOC and IRONSCALES on how AI is changing email attacks, which signals still hold up, what containment has to cover after a click, and where automation stops. Your browser can't play this video. [Download the recording](https://security.oneaxiom.com/hubfs/Webinars/October%202026%20Webinar/Recording%20-%20October%202026%20Webinar.mp4?hsLang=en). [Download the slides](https://security.oneaxiom.com/hubfs/Webinars/October%202026%20Webinar/Slide%20Deck%20-%20Webinar%20October%202026%20(2).pptx?hsLang=en) [Book a free 1:1 assessment](https://meetings-na2.hubspot.com/andie-prandini/intro?utm_source=hubspot&utm_medium=direct&utm_campaign=webinar-october-2026&utm_content=typ) Chapters 1. 02:57Welcome and speakers 2. 03:30How AI is changing email attacks 3. 09:25How attackers use LinkedIn 4. 13:52What stopped working, what works now 5. 17:49Don't trust. Just verify. 6. 19:22Why phishing spikes in the fall 7. 21:01After the click: containment 8. 24:57Where automation stops 9. 29:29Scoping and rising volume 10. 32:57Look ahead: prompt injection and deepfakes 11. 42:50Next steps Key takeaways ## Six things to bring back to your team Short on time? Each takeaway jumps to the moment in the recording where it comes up. ### Same attacks, more volume A phishing email that took 30 to 40 minutes to write now takes seconds. Expect ten times the suspicious messages. 05:30Watch ### Your calendar is a target Malicious invites look like a coworker's meeting request. One click on the join link can call out to an attacker. 06:45Watch ### Authentication isn't enough A compromised vendor mailbox passes DMARC, SPF and whitelists. Intent, domain age and sender history catch it. 13:52Watch ### Verify on another channel A hijacked Teams or email account will confirm its own request. Call or text the sender, or log in to the site directly. 34:23Watch ### After a click, look wider New forwarding rules and foreign MFA prompts are early signs. Trace email, endpoint and cloud data, then contain. 21:31Watch ### Automate the obvious Quarantine high-confidence threats on their own. Flag the gray areas for users and give them a fast path to an analyst. 24:57Watch Keep going ## Take the conversation further Compare the session to your own process, then see what your current setup is missing. ### The slides Every slide from the session, ready to share with your team or drop into your next quarterly security review. [Download the deck](https://security.oneaxiom.com/hubfs/Webinars/October%202026%20Webinar/Slide%20Deck%20-%20Webinar%20October%202026%20(2).pptx?hsLang=en) ### A free email threat scan IRONSCALES checks your last 90 days of email for threats your filters missed, then walks you through it. [Request the scan](https://meetings-na2.hubspot.com/andie-prandini/intro?utm_source=hubspot&utm_medium=direct&utm_campaign=webinar-october-2026&utm_content=typ) ### The next roundtable A live conversation with practitioners every month. Save a seat for November and bring your questions. [Invite me](https://meetings-na2.hubspot.com/andie-prandini/intro?utm_source=hubspot&utm_medium=direct&utm_campaign=webinar-october-2026&utm_content=typ) Questions ## What the session answers Short answers to the questions the roundtable covered. How is AI changing phishing attacks? Attackers use AI to write targeted emails in seconds instead of 30 to 40 minutes, so the same attack types arrive far more often. Newer vectors include malicious calendar invites, Microsoft direct send abuse, and lures built from details scraped from LinkedIn. Do DMARC, SPF and DKIM stop phishing? They verify the sender's domain, but they don't stop account takeover. When a trusted vendor's mailbox is compromised, its emails pass every check. Detection then depends on message intent, domain age, and whether the sender has written to the recipient before. What should you do after someone clicks a phishing link? Look for post-click signals such as new mailbox forwarding rules or MFA prompts from unusual countries. Trace email, endpoint and cloud telemetry together to get the full picture, then contain the affected machine and account. How should you verify a suspicious email? Use a different channel than the one the message came from. If an attacker controls a mailbox or Teams account, asking there gets a false confirmation. Call or text the sender, or log in to the vendor's site directly instead of clicking. Email security keeping you up at night? [Book a chat](https://meetings-na2.hubspot.com/andie-prandini/intro?utm_source=hubspot&utm_medium=direct&utm_campaign=webinar-october-2026&utm_content=typ) Before you go ## See where your email security stands today Book a free 30-minute 1:1 with our team. We'll review your stack and show you where AI-generated phishing would get through. - A review of your email and SOC coverage - Clear next steps, whether or not you work with us [Book my free 1:1](https://meetings-na2.hubspot.com/andie-prandini/intro?utm_source=hubspot&utm_medium=direct&utm_campaign=webinar-october-2026&utm_content=typ) No thanks, I'll keep watching [![OneAxiom](https://security.oneaxiom.com/logo-oneaxiom.svg)](https://oneaxiom.com) [info@oneaxiom.com](mailto:info@oneaxiom.com) / [+1 (703) 997-9600](tel:+17039979600) 999 Vanderbilt Beach Road, Suite 200, Naples, FL 34108 ```json { "@context" : "https://schema.org", "@type" : "VideoObject", "contentUrl" : "https://243149891.fs1.hubspotusercontent-na2.net/hubfs/243149891/Webinars/October%202026%20Webinar/Recording%20-%20October%202026%20Webinar.mp4", "description" : "A roundtable with OneAxiom's SOC and IRONSCALES on how AI is changing email attacks, which signals still hold up, what containment covers after a click, and where automation stops.", "duration" : "PT41M", "name" : "What should your SecOps team do when AI-generated phishing gets past the filters?", "publisher" : { "@type" : "Organization", "name" : "OneAxiom", "url" : "https://oneaxiom.com" }, "uploadDate" : "2026-10-20" } ``` ```json { "@context" : "https://schema.org", "@type" : "FAQPage", "mainEntity" : [ { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Attackers use AI to write targeted emails in seconds instead of 30 to 40 minutes, so the same attack types arrive far more often. Newer vectors include malicious calendar invites, Microsoft direct send abuse, and lures built from details scraped from LinkedIn." }, "name" : "How is AI changing phishing attacks?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "They verify the sender's domain, but they don't stop account takeover. When a trusted vendor's mailbox is compromised, its emails pass every check. Detection then depends on message intent, domain age, and whether the sender has written to the recipient before." }, "name" : "Do DMARC, SPF and DKIM stop phishing?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Look for post-click signals such as new mailbox forwarding rules or MFA prompts from unusual countries. Trace email, endpoint and cloud telemetry together to get the full picture, then contain the affected machine and account." }, "name" : "What should you do after someone clicks a phishing link?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Verify on a different channel than the one the message came from. If an attacker controls a mailbox or Teams account, asking on that channel gets a false confirmation. Call or text the sender, or log in to the vendor's site directly instead of clicking." }, "name" : "How should you verify a suspicious email?" } ] } ```