AI-generated phishing attacks are making malicious emails harder to detect, but for managed service providers, the growing complexity of email security poses another risk: declining profitability. As threats become more sophisticated, MSPs must balance stronger protection against the support costs and administrative workloads required to deliver it.
For Ben Hathaway, CTO and co-owner of email security vendor Mailprotector, the evolution of email threats raises a fundamental question: Are traditional email security products built to defend against attacks that no longer look suspicious?
“The initial attack doesn’t look like an attack anymore, especially if you’re basing it on the content,” Hathaway told Channel Insider.
AI-powered phishing challenges traditional email defenses
Generative AI has changed the economics and sophistication of phishing by allowing attackers to create personalized messages, research potential victims, and sustain convincing conversations.
Hathaway described demonstrating how AI could research Mailprotector’s CEO, identify a recent speaking engagement, and generate an email referencing that event.
“It kind of almost scarily spoke to what I know about him,” Hathaway said. “That would actually get him to respond.”
Meanwhile, AI-generated sales outreach and other unwanted messages are creating a separate productivity challenge. The increasing volume and variation of these emails make traditional content-based filtering less effective.
Hathaway believes MSPs should look beyond vendors’ AI marketing claims and examine the underlying security architecture.
“Just slapping [AI terms] into your marketing doesn’t really mean your product’s principles have changed and adapted for this,” he said.
Instead of relying primarily on message content, Hathaway advocates evaluating signals such as sender information, domain age, geographic origin, and other email metadata, which are more difficult to manipulate.
That philosophy informed Mailprotector’s development of Shield, its zero trust email security platform, before generative AI became a mainstream concern.
“We didn’t predict the future. I didn’t see AI coming,” Hathaway acknowledged. “We just kind of got lucky in that way.”
Why email security is becoming an MSP profitability issue
For MSPs, stronger security controls can introduce another problem: increased support tickets when legitimate messages are blocked, or users struggle with security workflows.
Hathaway said this operational burden often shapes how partners evaluate new email security technologies.
“Are customers going to have to go through a bunch of reports and find the stuff they wanted?” he said, describing common partner concerns about zero trust approaches.
Mailprotector’s response has been to provide end users with greater visibility and control over their email security experience, enabling them to resolve routine issues without contacting their MSP.
The business implications are significant, according to Hathaway.
“If they spend time unnecessarily either deploying, managing, or supporting the product, that is their margin drifting away from them.”
Mailprotector launches Shield Blueprints to reduce overhead
The company is extending that approach with the October 22 launch of Shield Blueprints, which allows MSPs to standardize security configurations across multiple customers, automatically apply policies to new organizations, and maintain different configurations for industries or service tiers.
Mailprotector also plans additional Shield capabilities this fall, including delegated access, unwanted-email reduction, user personalization, and safer sharing of suspicious-message analysis.
The broader objective is to reduce repetitive administration and support requests without compromising security.
What MSPs should prioritize in email security for 2027
Looking ahead, Hathaway expects AI-generated phishing and unwanted email volume to continue increasing. However, he cautioned against assuming that adding more AI capabilities automatically improves protection.
He said that Mailprotector has deliberately taken a measured approach to incorporating AI into its products, focusing on identifying applications where the technology can deliver meaningful improvements.
“When you’re at the beginning of a technological wave, like we are with AI, being patient and finding the right jobs to put that technology to use on is key,” Hathaway said.
For MSPs, that suggests evaluating email security platforms on more than just detection capabilities. The underlying defensive approach, end-user experience, administrative efficiency, and support requirements all influence whether a solution can scale profitably.
As attackers increasingly use AI to make malicious messages appear legitimate, the challenge for MSPs will be delivering stronger protection without allowing security management itself to become another source of operational complexity.
READ MORE: We spoke with Mailprotector founder and CEO David Setzer at ChannelCon this year about how MSPs can evolve to meet the needs of the AI era.