Gains:
- Ability to analyze a suspicious email at three layers (content/social engineering, URL/attachment structure, headers and SPF/DKIM/DMARC) with artificial intelligence support
- Ability to apply the discipline of analyzing suspicious links in the live system without clicking them and validating the AI's 'phishing/safe' decision with title, domain reputation and context
- Ability to recognize that artificial intelligence does not know the institutional context and may mistake legitimate e-mail for phishing (false positive) and make the decision to block it as an analyst
Most attacks start from deceiving a person, not from a technical vulnerability. Phishing is a social engineering attack that attempts to trick the victim into obtaining passwords, card information, or clicks by deceiving the victim with a fake email, message, or website. An employee falling for a "your shipment could not be delivered, click here" message or "the general manager requests an urgent transfer" will bypass even the most advanced firewall. That's why analyzing suspicious emails quickly and accurately is a security team's daily bread.
Artificial intelligence is very powerful in phishing analysis because phishing is, at its core, a language and pattern problem. AI can parse an email's tone, pressure of urgency, grammatical quirks, fake brand impersonation, and suspicious link structure in seconds; can explain why a URL is deceptive; It can flag inconsistencies in email headers. But AI can't (and shouldn't) verify by clicking that a link is actually malicious, and it can't make the final determination that an email is actually fake in a corporate context. AI analyzes phishing and justifies suspicion; The analyst makes the decision "this is phishing, block/delete" and the notification to the user.
What to look for in a phishing email
When examining a suspicious email, three layers are looked at, and AI helps at each layer:
- Content and social engineering. Pressure of urgency (“immediately”, “your account will be closed”), dissimulation of authority (“general manager”, “IT department”), fear/reward, grammatical errors, lack of personalization. AI deciphers tone and persuasion techniques well.
- Technical indicators — link and attachment. Difference between the displayed text and the real URL, fake domain name with similar letters (typosquatting; e.g. paypa1.com), URL shortening, suspicious file attachments (.html, .iso, Office files containing macros). AI analyzes the URL structure.
- Email headers. Sender's real domain name, SPF/DKIM/DMARC verification results (three authentication mechanisms that prove the email really came from the domain it claims to be), server path inconsistencies. AI summarizes the titles and flags inconsistencies.
An important security rule: Never click suspicious links on a live system. URL analysis is done via text, in an isolated (sandbox) environment if necessary. Having the AI analyze a URL is not "visiting" it; but don't assume the AI can also access that site — the analysis is based on structure and known threat intelligence.
Phishing dashboard
layer
doubt sign
Contribution of AI
border
Content
Urgency, authority, fear pressure
Tone and persuasion technique analysis
Doesn't know the context
Posted by
Domain impersonation, inconsistent name
Similarity/typosquat detection
Does not recognize the institution
URL
Apparent ≠ real, simulated area
Structure analysis, explanation
Can't click and confirm
Annex
Dangerous extension, macro
Extension/type risk assessment
Can't run the file
Title
SPF/DKIM/DMARC failed
Title summary, inconsistency
Verify the result
Context
unexpected request
generates questions
The decision is in the hands of the analyst
three mini cases
Case 1 — Diagnosis in 30 seconds. A user finds the "from your bank: your account has been frozen, verify" email suspicious and forwards it to the security team. The analyst gives the email (masking the personal data) to the AI. AI summarizes in 30 seconds: sender domain name is guvenli-banka-tr.info (not the bank's real domain), URL is ostensibly the bank but the real target is a different domain, DKIM verification failed, language puts pressure on urgency. The analyst himself confirms these indicators in the header and URL, declares the email phishing, and blocks the entire organization. AI has accelerated analysis; The analyst made the decision.
Case 2 — Mistaking a legitimate email for phishing (false positive). The AI flags an email as “suspicious, possibly phishing: originates from an external domain and contains a link.” The analyst checks the context: the email comes from the organization's actual HR software provider, SPF/DKIM/DMARC are all valid, and that provider has been around for years. The AI flagged a legitimate email because it didn't know the context. The analyst corrects the false positive. Lesson: AI's "phishing" sign is a hypothesis; Without title verification and institutional context, it does not turn into a decision.
Case 3 — Contrived “safe” decision. An analyst gives the AI a URL and asks “is this safe?” he asks. The AI says “yes, this is a known and secure domain.” But the AI hasn't actually looked at that site; The domain name is a newly registered typosquat with no reputation, and the model produced a positive response because it thought it was "useful" to give trust. The analyst himself checks the registration date and reputation services of the domain name and sees the danger. Lesson: Just because the AI says "safe" is not evidence; The domain name is confirmed by age, reputation and title data.
Weak prompt / Strong prompt
Weak prompt:
Is this email phishing, tell me yes/no: [email]
This prompt asks the AI for a direct decision (yes/no), it does not ask for justification or evidence, it does not question the possibility of a false positive. The AI's one-word answer may be misleading and personal data may have gone unmasked.
Powerful prompt:
Your role: Assistant to SOC analyst preparing phishing analysis DRAFT. Decision making; Don't say "it's phishing, delete it". Analyze the following anonymized email in three layers: (1) content/social engineering signals (urgency, authority, fear, language), (2) URL structure — difference between apparent and actual target, typosquat, impersonation; but don't assume you have visited any links, (3) headers include SPF/DKIM/DMARC and sender discrepancy — mark the result as "[confirm in header]". State how strong the evidence is for each sign; Also write at least 2 innocent (false positive) explanations. Fabricated reputation/decision generation. Email: [anonymous paste]
The strong claim separates the three layers, questions the strength of evidence, enforces the false positive, prohibits the presumption of clicking and fabrication.
Copiable prompt templates
EMAIL CONTENT ANALYSIS TEMPLATE Analyze the text of the following anonymous email for social engineering: pressure of urgency, authority/brand impersonation, fear/reward, lack of personalization, language/tone quirks. Show each sign with a quote. Don't decide; just list the marks and power rating. Email: [paste]
URL ANALYSIS TEMPLATE (without clicking) Analyze the following URL as STRUCTURE (do not visit, do not assume): difference between apparent text and actual target domain, typosquat/letter spoofing, subdomain spoofing, abbreviation, suspicious parameter. DO NOT FAKE the reputation of the domain name; Mark "reputation/registration date should be checked separately".URL: [paste]
HEADER INSPECTION TEMPLATE Summarize the following email headers: real sender domain, Return-Path, SPF/DKIM/DMARC results, server path (Received) inconsistencies, display name and real address difference. Mark each result with "[confirm in raw header]"; fitting. Headings: [paste]
USER WARNING DRAFT TEMPLATEWrite a short, calm, non-accusatory DRAFT warning text to be sent to employees for confirmed phishing: what to do (do not click, forward, delete), why, to whom to report. Don't use panic language. This draft passes through analyst approval. Event summary: [paste]
Common mistakes
- Live clicking on the suspicious link. Analysis is done through text and isolated media; live click can make you a victim too.
- Trusting the AI's yes/no decision. The single word "phishing/secure" is not evidence; Confirm by title, URL structure, and domain.
- Bypassing the institution context (false positive). Legitimate providers also send emails from external domains; See SPF/DKIM/DMARC and historical usage context.
- Giving personal/sensitive data without a mask. Mask the name, address, card/password information in the e-mail before analysis.
- Mistaking the fake field reputation as true. AI can fake that an area is “safe/known”; Confirm with registration date and reputation services.
Tip: The single strongest indicator in phishing analysis is often the header: if SPF/DKIM/DMARC all fail and the sender domain is spoofed, suspicion becomes very strong. But confirm this from the raw title, not from the AI summary.
Caution: Declaring an email "phishing" and blocking it across the organization can also disrupt a legitimate business email. Analysis of AI is a justification; The decision to block and user notification rests with the analyst after title and context verification.
In summary
Phishing targets people, not techniques, and is essentially a language and pattern problem; That's why it is so powerful in AI analysis. A suspicious email is examined at three layers: content/social engineering, URL/attachment structure, and email headers (SPF/DKIM/DMARC). AI generates rapid justification at every layer, but cannot verify a suspicious link by clicking on it, does not know the institutional context, and can make up a “safe/phishing” decision. So AI analysis is a hypothesis: title verification is confirmed by domain reputation and institution context, then the decision to block and user notification is made by the analyst. Two rules remain constant: don't click on suspicious links live, don't share sensitive data without a mask.
Application task
Get a sample of suspicious emails (either anonymized or a sample from your own quarantine). Have the AI resolve the three layers separately with the "Content", "URL" and "Title" templates. Verify yourself in the raw data (especially SPF/DKIM/DMARC in the header) the strongest indicator that the AI is marking at each layer and consider at least one false positive explanation. Finally, decide: is this phishing or not, and why — write down what evidence you base your decision on.
checklist
- [ ] I anonymized the email before analysis; personal/sensitive data has been masked.
- [ ] I examined the three layers (content, URL/attachment, title) separately.
- [ ] I did not click any suspicious links live; I parsed the URL as a structure.
- [ ] I verified the SPF/DKIM/DMARC result in the raw header.
- [ ] I confirmed the AI's "phishing/safe" decision with evidence, I did not blindly trust it.
- [ ] I have considered at least one false positive (innocent) statement.
- [ ] As an analyst, I made the decision to block and notify users.