Why We Don't Use AI to Fight AI Phishing

Every email security vendor is in the same race right now. AI-generated phishing volumes have risen sharply in the last year. Click-through rates on AI-crafted messages reliably outperform traditional phishing. Generative models make it cheap to produce clean, native-language, context-aware pretext at scale, and the effectiveness gap over old-school phishing keeps widening.

The industry response has been uniform. Build better AI defenders. Train larger models on phishing corpora. Deploy AI-based filters to meet AI attackers on their own terms. Call it an arms race and promise to win it.

Rythm is deliberately not in that race. This is not a refusal to take phishing seriously. It is a position on what kind of filter actually works in the long run. Here is the reasoning.

Content Analysis Is an Arms Race the Attacker Gets Paid to Win

A content-based filter scores incoming email on patterns that predict spam or phishing. Subject line markers. Urgency language. Mismatched sender domains. Link patterns. Attachment signatures. The score crosses a threshold and the email is flagged.

The attacker’s job is to beat that score. When the filter tightens, attackers iterate on prose until they pass. When the filter introduces a new heuristic, attackers study it and route around it. The filter has a fixed budget (the defending team). The attacker has a variable budget that grows with the payoff of a successful attack. BEC payoffs routinely run into six figures per incident. Ransomware runs much higher. The economic asymmetry favors the attacker as long as the defense is content-based.

This is not a race with a finish line. Every generation of content filter produces a generation of adversarial content that defeats it. That is the structure of the race, and the structure does not change when you throw AI at both sides. Better defenders produce better attackers, because the attackers have economic reason to study the defender and the defender is a published model or a scannable heuristic set.

Rythm’s read on this race is that it is unwinnable as a standalone defense, which is why the industry has been running it for twenty years and phishing losses keep going up.

What a Cover Charge Actually Filters On

Rythm does not score content. The filter asks one question: is the sender on the recipient’s guest list?

• If yes, the email walks in.
• If no, the sender either pays a small cover charge (about four cents by default) or their email waits in a separate folder for the recipient’s review.

The filter is binary and rule-based. It does not try to predict anything. It does not guess. It does not analyze subject lines, body text, or attachments to decide what to do. It makes an identity check and applies a rule.

The filter is also cheap on the defense side and expensive on the attack side. To beat it, an attacker has to pay. Four cents per target. For a mass phishing campaign targeting 100,000 mailboxes, that is $4,000 per campaign. The economics of mass phishing collapse the moment there is any cost at all. The cheap-and-broad attack profile (which is 95% of actual phishing volume) stops working.

The filter is behavior-based rather than content-based. That distinction is structural, not aesthetic.

What About AI Phishing That Pays Through?

A targeted attacker with a real budget can pay the cover charge and reach the inbox. This is true. It is also fine.

The cover charge was never designed to detect lying. It was designed to separate senders who are reaching you on your terms (pay or wait for review) from senders who are reaching you on zero-cost terms (mass blast at anyone with an email address). Once a sender has paid, they have passed the “did you value this enough to invest in it” test. Whether they are lying about their identity is a different question, and it is the same question that applies to any unknown-sender email from any source.

A paid phishing attempt arrives in your inbox labeled PAID. It is a single email. Your normal human scrutiny applies. You notice the weird wire instructions. You verify out of band. Or you do not, and the attack succeeds, the way a sufficiently good attack has always succeeded against every defense in history.

What Rythm eliminates is not every possible phishing email. What Rythm eliminates is the cheap phishing email. The mass-blast attack. The automated campaign targeting a thousand inboxes per minute. The economics of those attacks depend on reaching every inbox at zero cost, and Rythm removes that zero.

The Layering That Actually Matters

Rythm is not a replacement for your spam filter. It sits on top of it.

Gmail’s spam filter catches the obvious mass fraud (Nigerian princes, malware attachments, credential-harvesting links from known-bad domains). Outlook’s filter does similar work. Proofpoint, Mimecast, and Abnormal do this work at the enterprise scale with more elaborate content analysis and sandboxing. These filters are the first layer. They do real work, and Rythm does not try to replace them.

What they cannot do is stop the email that is not technically spam. The clean, professional, well-written message from a sender you have never corresponded with. The cold pitch. The BEC attempt that spent three weeks reading your real thread before striking. The AI-written outreach that passes every content heuristic because it is, technically, indistinguishable from legitimate outreach.

That is the layer Rythm adds. Not a better version of the content filter. A different kind of filter, one that does not care what the email says, only whether the sender cared enough to pay to be heard.

The two layers together handle more of the threat space than either layer alone. Your spam filter handles mass mechanical spam. Rythm handles unknown-sender intent.

Why This Framing Matters for Users

When someone asks, “does Rythm stop AI phishing,” the honest answer is not “yes” or “no.” The honest answer is, “Rythm collapses the economics of mass phishing, including AI-written mass phishing. It does not try to detect one-off targeted phishing through content. Those are different attacks with different defenses, and Rythm does the former structurally.”

This is worth saying clearly because the industry uses “AI phishing protection” as a marketing wrapper and the phrase has come to mean almost nothing. Many vendors claiming to stop AI phishing are using AI content classifiers that are themselves trained on AI phishing, which is the same arms race with new skins.

Rythm’s frame is different. The attacker’s ability to write clean prose is not relevant if the attacker cannot afford to reach the inbox. That is what behavior-based filtering actually means.

The Cleaner Version of the Pitch

You do not need a smarter guessing machine. You need a filter that does not have to guess. Identity is not a content signal; it is a membership question. Intention is not a linguistic signal; it is a payment signal. Behavior is not a language model output; it is a sequence of observable actions.

Rythm runs on the two signals that cannot be faked by better prose: is this sender known to you, and did they value reaching you enough to put a tiny amount on the line? Those two signals collapse most of the volume of what used to be called spam and what is now called phishing.

The arms race is somebody else’s war. Rythm built the filter you need when you want out of that war entirely.