AI Email Threats Are Making MSP Margins Drift Away

AI-generated phishing has made bad email harder to spot, because the message no longer carries the clumsy signs filters were built to find. For managed service providers, the cost lands twice: in the attacks that get through, and in the hours spent deploying, tuning, and supporting the tools meant to stop them. In an article for Channel Insider, Managing Editor Victoria Durgin examines how that combination puts MSP profitability under pressure. Mailprotector CTO Ben Hathaway explains why the answer is not simply more AI.

Hathaway’s argument is that content is the wrong thing to lean on once the content itself is convincing. He points instead to signals that are harder for an attacker to manipulate, including sender information, domain age, and geographic origin. The operational side matters just as much. Time an MSP spends deploying, managing, or supporting a product is time it cannot bill for, so it comes straight out of profit.

“If they spend time unnecessarily either deploying, managing, or supporting the product, that is their margin drifting away from them.”

Read the full piece, including what Hathaway expects from AI phishing volume into 2027, in AI Email Threats are Putting MSP Security Margins at Risk by Victoria Durgin at Channel Insider.

Read the full story at Channel Insider Read the article channelinsider.com

What This Means for MSP Email Security Practices

The Channel Insider article connects two problems MSPs usually evaluate separately: whether a filter can stop a convincing attack, and what that filter costs to run every week. Below, we answer a few of the questions we are hearing from MSPs about what that means in practice.

Can traditional email security catch AI-generated phishing?

Often, but content inspection is doing less of the work than it used to. A generative AI model can research a recipient, reference a real event, and write in clean, plausible language, so the message no longer trips rules built around awkward phrasing or known bad copy. The signals around the message hold up better, including whether the sender has written to this person before, how old the domain is, where the mail originated, and whether authentication checks pass, much like those evaluated in Shield. No filter catches everything, which is why email security belongs alongside the rest of the stack, including ITDR or MDR.

What does zero trust mean for email security?

Zero trust email security treats every message as untrusted until it earns its way in. Email runs on an open protocol that accepts mail from strangers by default, so a traditional filter starts from trust and subtracts. Zero trust reverses that. The evidence that lets a message through comes from things an attacker cannot easily fake: an established relationship with the sender, valid authentication, where the message came from, and what it is asking the recipient to do.

The harder cases are not the obvious attacks. A large share of email is legitimate but unwanted, sometimes called graymail: sales outreach, bulk mail, and notifications, and AI has increased the volume of it. One person’s useful vendor update is the next person’s clutter, so a single company-wide setting tends to be wrong for somebody. This is why zero trust implementations separate the unwanted from the dangerous and push the call down to the person receiving the mail.

Which of Mailprotector’s products reduce email security support costs for MSPs?

Shield is Mailprotector’s zero trust email security filter built to work with Microsoft 365. It uses a hybrid email security model, blending a traditional secure email gateway with modern APIs to protect users at both the perimeter and the inbox. Shield assumes an arriving message is high risk, then looks for markers that it is good, and enough no-risk indicators make it deliverable. Nothing earns trust on appearance alone. That cuts support work from both ends. A user can open a blocked message in X-ray, a sandbox that shows which aspects caused the block, instead of filing a ticket. An administrator can use Shield Blueprints to apply one configuration across customer organizations and set the defaults new ones inherit.