Amazon Bedrock: how it detects AI-generated phishing

Amazon Bedrock catches AI-generated phishing by layering foundation-model analysis and configurable Guardrails on top of standard email controls, evaluating messages for behavioral anomalies, context misalignment and content manipulation before delivery. The service runs a multi-stage pipeline that combines authentication checks, model-driven analysis and a 0–100 risk score to decide whether to deliver, quarantine or block a message.

How does Amazon Bedrock detect AI-generated phishing?

Amazon Bedrock detects AI-crafted phishing by analyzing behavioral patterns and contextual relationships rather than relying on grammar or formatting. The system uses pre-trained foundation models to spot subtle manipulation, deviations from a sender's baseline style and inappropriate requests, and it applies configurable Bedrock Guardrails to prevent sensitive-data exposure during analysis.

The detection approach supplements standard authentication checks with model-based reasoning. Messages first pass SPF, DKIM and DMARC checks, then move into an AI analysis stage that compares word choice, communication style and contextual appropriateness against known phishing examples and an internal sender baseline.

How does the multi-stage analysis pipeline work?

The pipeline runs five steps: input guardrails and pre-processing, prompt construction with context, AI analysis with Guardrails, multi-factor risk scoring, and classification with automated routing. It builds prompts that include the email, sender baseline patterns, organizational context and known phishing examples, then invokes a foundation model while Guardrails screen inputs and outputs.

Implementation details in the workflow include a sender baseline tracker that logs how employees normally write, an email knowledge base for phishing examples, and configuration for PII protection and content filtering. The sample initialization sets up an Amazon Bedrock client using the Claude Sonnet 4.5 model and risk thresholds where safe is below 30, suspicious is below 70, and dangerous is 70 or above. From the model analysis the pipeline produces three component scores for content anomalies, behavioral deviation and context alignment, which are combined into a single 0–100 risk score that determines routing: DELIVER, QUARANTINE or BLOCK.

How do Bedrock Guardrails fit into email analysis?

Bedrock Guardrails provide configurable safeguards that filter inputs and outputs, redact sensitive personally identifiable information and enforce your organization’s policies during analysis. They prevent the foundation model from generating responses that could leak confidential data while allowing the model to examine suspicious content that might otherwise be blocked by generic content filters.

Guardrails require careful calibration. Overly restrictive filters can stop legitimate analysis of offensive or unusual content that needs review, while too-permissive settings risk exposing sensitive data. Guardrails also include contextual grounding checks to help reduce hallucinations and false positives by anchoring model outputs to the email content being evaluated.

Why it matters

AI-enabled attackers can generate grammatically perfect, contextually accurate and personalized messages that evade rule-based filters. Moving detection from surface signals to behavioral and contextual analysis changes what security teams must monitor: not just whether a sender is authorized but whether the message matches how a person actually communicates. For security teams, integrating model-driven inspection with existing routing systems offers a path from reactive filtering to proactive detection.

Bedrock’s pipeline is designed to operate alongside existing infrastructure, and the post notes these inspection steps run in milliseconds as messages move through routing, so they can be applied without replacing mail delivery systems.

What to watch

Watch how organizations set and tune Guardrail configurations and risk thresholds, because those settings determine whether suspicious content is analyzed or inadvertently blocked. The next concrete signals to follow are operational metrics: false positive rates after sender-baseline training, and whether teams adjust the safe (<30), suspicious (<70) and dangerous (>=70) thresholds used in the sample workflow.