From reactive to proactive: closing the phishing gap with LLMs (opens in new tab)
Cloudflare argues that email security must move beyond reacting to user-reported phishing misses. LLMs can analyze millions of emails, reveal emerging threat patterns that traditional systems overlook, and guide specialized detection models before attacks become widespread. Its Sales Outreach phishing program reportedly reduced average daily reported misses by 20.4% from Q3 to Q4 2025, with a further two-thirds decline in Q1 2026. ## The Blind Spot in Reactive Defense - Traditional systems improve mainly after users report messages that were incorrectly classified as clean. - This feedback is valuable but inherently delayed: it reveals attacks that already succeeded. - The authors compare this problem to Abraham Wald’s World War II aircraft analysis: - Engineers studied bullet holes on returning planes. - Wald identified the missing data—the damage on planes that never returned. - Email security faces the same challenge because undetected threats are largely invisible. ## Mapping Threats with LLMs - LLMs can interpret context, intent, urgency, deception, and other nuanced characteristics in natural-language emails. - Cloudflare processes millions of unwanted messages daily, making manual classification and detailed threat mapping impractical. - LLM-generated categories expose emerging patterns and persistent trends, including: - `PrizeNotification` - `SalesOutreach` - These tags give analysts near-real-time, high-fidelity signals and reduce the need for manual investigation. - The resulting intelligence helps Cloudflare create or retrain targeted machine-learning models before threats become widely visible through customer reports. ## Detecting Sales Outreach Phishing - Sales Outreach phishing imitates legitimate B2B communication, using offers, special deals, or transactional requests to encourage malicious clicks or credential disclosure. - After identifying it as a major threat category, Cloudflare used LLM tags to build a continuously growing corpus of relevant messages. - Training data was grouped by linguistic and structural traits such as: - Persuasive framing - Manufactured urgency - Transactional language - Subtle social proof - Feature extraction focused on sentiment and intent rather than static indicators. - A specialized sentiment-analysis model was trained for Sales Outreach behavior instead of overloading a general phishing classifier. ## From Classification to Enforcement - The specialized model produces a risk score based on how closely an email matches known Sales Outreach patterns. - That score is combined with other signals, including: - Sender reputation - Link behavior - Historical context - Messages can then be allowed, quarantined, or blocked. - LLMs serve as the discovery layer, identifying new language variants, while the specialized model provides fast, scalable enforcement. - Newly detected examples continuously feed back into the pipeline as attackers change their tactics. ## Reported Results - Cloudflare says the proactive approach reduced customer-reported Sales Outreach misses. - Average daily submissions fell from 965 in Q3 2025 to 769 in Q4 2025. - This represented a 20.4% quarterly reduction. - The company reports that average daily submissions decreased by another two-thirds in Q1 2026. - Fewer misses mean less analyst work, fewer interruptions for users, and fewer opportunities for phishing messages to reach inboxes. Cloudflare’s approach recommends combining broad LLM-based threat discovery with narrowly focused detection models. This creates a proactive feedback loop that can identify and address emerging phishing techniques before relying on large volumes of user-reported failures.