AWS details how Amazon Bedrock can be used to detect AI-generated phishing emails

Amazon Bedrock is presented as a tool to augment existing email security infrastructure by adding AI-driven analysis that goes beyond surface-level filtering. The post emphasizes that modern phishing emails, often generated using generative AI and open-source intelligence, are increasingly indistinguishable from legitimate communications due to their grammatical precision, contextual relevance, and personalization.

The proposed workflow integrates Amazon Bedrock’s foundation models with standard email authentication protocols—Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting and Conformance (DMARC)—to perform multi-stage analysis. Each email undergoes authentication checks before being evaluated for behavioral patterns, communication style deviations, and contextual appropriateness of requests.

The analysis leverages pre-trained foundation models capable of detecting nuanced manipulation, contextual anomalies, and impersonation patterns that rule-based systems often miss. This includes evaluating word choice, style deviations, and misaligned requests to identify subtle inconsistencies indicative of phishing attempts.

Amazon Bedrock Guardrails are introduced as a configurable safeguard to align model interactions with responsible AI policies. These guardrails filter input prompts and model outputs, prevent data leakage, and enforce content policies. For example, they can automatically redact sensitive personally identifiable information (PII) discovered during analysis to mitigate the risk of confidential data exposure.

The post highlights the need for careful calibration of guardrails to avoid over-restriction that could hinder legitimate security analysis. Overly aggressive filters might block the evaluation of suspicious content that requires deeper inspection, such as emails containing offensive language used to bypass traditional filters. Guardrails also include contextual grounding checks to reduce false positives by anchoring model responses to the email content being analyzed.

The solution is framed as a five-step email security analysis workflow, extending beyond authentication to include AI-driven behavioral analysis and risk scoring. This approach aims to shift security teams from reactive filtering to proactive detection, enabling them to identify AI-generated phishing attempts before they reach end users.