The most dangerous email in your inbox is the one that passes every check you run. It comes from a real domain, carries valid credentials, and rides on a sender with a clean reputation. Nothing about it is forged, and that's exactly why it gets through.
Rules are only as current as their last update
A signature works like a statute. Someone spots an attack, writes a rule describing it, and from that point you're covered against that attack and its close cousins. It's fast and predictable. It's also blind to anything nobody has written a rule for yet.
The industry's response was to add more rules. Anomaly detection and behavioral models scale that approach: they learn from what already happened and score how far a new message strays from the pattern. They're more capable than signatures, but they're still matching against the past. A zero-day is a crime with no rule on the books.
Here's the thing: the worst failures don't involve messages that trip a check. They involve messages that clear every one. Verizon's 2026 Data Breach Investigations Report found that breaches involving a third party now account for 48% of the total, a 60% increase in a single year. When a supplier's mailbox is compromised, the request arrives from a legitimate domain with valid credentials. Every control reports a pass because the infrastructure really is genuine.
Email authentication works as designed here. It confirms the message came from the domain it claims. It has no mechanism for deciding whether the request behind that message deserves to be believed.
Attackers have noticed. You don't need to defeat a rule that's already in place; you only need to do something the rules weren't written to cover. The FBI's 2025 Internet Crime Report put business email compromise losses above $3 billion in a single year, and much of that money moved on messages that broke no rule, because no rule described them.
What a reasoning system does differently
Common law offers a useful model. A judge facing a situation no statute anticipated doesn't stall. She works from principle and precedent toward a ruling, adapting case by case. The system isn't waiting for someone to rewrite the code. It's built to weigh a new set of facts.
The obvious objection is that reasoning systems learn from history too, and that's true. Still, matching a message to a stored pattern is different from applying a principle to a case you've never seen. A good judge handles a dispute she's never encountered, because she knows how to weigh evidence.
That distinction matters in practice. A signature-based system can report that something matched or deviated. A reasoned verdict can list its evidence: what the sender actually is, whether the relationship supports the request, what the message is asking the recipient to do. You can check that evidence, challenge it, and overturn the decision if the facts don't hold. That's the opposite of a black box.
None of this means abandoning the fast rules. Most mail is clear-cut and should be dealt with in milliseconds. Keep the quick checks for the easy calls, and reserve the full analysis for the messages that are actually contested.
This doesn't conflict with zero trust, either. Zero trust governs access: who gets in and what they can reach, with no assumptions. A verdict answers a different question, namely whether a given message is what it claims to be. For that question, the right posture isn't presumed guilt or presumed innocence. It's letting the evidence decide.
Where humans still belong
Even good courts don't let the machinery decide everything alone. The highest-stakes matters go to a person, and security should work the same way. When a message asks for a wire transfer, a change to vendor banking details, or a payroll redirect, the system shouldn't render a silent verdict and hope it's right. It should escalate and ask the account owner to approve the action directly.
That split gives you a clear design rule: automated reasoning handles the general docket, and the human serves as the court of last resort for decisions that warrant one. Match the level of scrutiny to the cost of being wrong.
No analogy is perfect. Real judges do more than apply evidence, and civil-law systems evolve through their own doctrine rather than through common-law precedent. The point isn't to crown one legal tradition. It's that a system able to reason about new facts beats one that can only pattern-match against old ones.
The question to put to your team
For most of this industry's history, that choice didn't really exist. Machines could apply a code but couldn't weigh evidence to reach a judgment. That's changing.
There's a simple way to test which kind of defense you're running. Ask your team how many user-reaching attacks came through infrastructure you already trust: a compromised vendor, a real account, a genuine DocuSign or Microsoft notification bent to a purpose it was never meant to serve. If that number is high, your defenses aren't failing. They're enforcing their rules perfectly, against threats those rules were never built to recognize.
So the question isn't whether your rules are up to date. Rules are always current only as of yesterday. The question is whether your security can rule on a case it has never seen, because that's the case most likely to cost you.
