Phishing was the crude end of fraud: a misspelt email, a foreign bank, a link nobody who was paying attention would click. Awareness training worked against it because there was something to be aware of.
Superintelligence rebuilt the whole chain, and the result is the category the FBI's Internet Crime Complaint Center now ranks second by losses: business email compromise, at $3.04 billion for corporate victims in 2025, with cloned executive voices and fabricated video called out for the first time in the report's history.
The chain, as it runs now
The lure is written in your idiom. A superintelligent agent reads the target organisation's public footprint: press releases, job adverts, LinkedIn posts, conference talks, the CEO's interviews. The email it writes uses the right internal vocabulary, references a real project, lands on the afternoon the real executive is known to be travelling, and contains nothing a filter or a careful reader would catch.
The domain is a character off and fully dressed. The lookalike is registered automatically, with a valid certificate, working mail, a cloned website and a mail-authentication record that passes. The vendor portal the target is sent to is a pixel-accurate copy of the real one. The invoice attached is the real invoice, intercepted and altered.
The follow-up is a voice or a face. When the target hesitates, the call arrives: the CFO's voice, or the vendor's account manager on video, apologising for the urgency and confirming the new bank details. The hyper-humanised agent holds that call indefinitely.
The insider is hired, not recruited. The furthest point of the chain is the synthetic employee: a candidate with a plausible history and a verified-looking identity who passes a remote interview conducted entirely by an agent, is onboarded, issued credentials, and becomes an insider that is not a person. The remote-only workforce is now a delivery vector, not just a target.
Each step existed before. Superintelligence made each one cheap, consistent and parallel, so an operation runs the full chain against thousands of organisations at once and lets the numbers do the work.
Why the old controls fail
Awareness training asks a person to notice what has been built to be unnoticeable. Mail filtering catches templates and known-bad infrastructure, not a bespoke message from a freshly registered, correctly authenticated domain. Approval workflows assume the person confirming on the phone is the person. Background checks assume the candidate on the call is a candidate.
Every one of those controls depends on a human judgement that superintelligence has learned to pass.
What Monolith does about it
Monolith does not attempt to out-read the phishing email. It defends the layer the campaign cannot run without, and it does so continuously, with action rather than advice.
Administrative control is the perimeter. Domain names, registrars, DNS, certificate authorities and mail authentication are where an impersonation campaign is built and where an organisation is taken over without touching a host. Monolith inventories and monitors all of it: registrar lock, DNS change detection, certificate issuance monitoring, DMARC, SPF and DKIM validation, and MFA on every administrative console are controls it validates, not assumptions it makes. Lookalike registrations against your names are surfaced the day they appear.
Identity is verified before it acts. Internal requests to pay, change, grant or export are honoured only from identities and devices that qualify on a trusted compute layer: attested endpoint, verified session, stated authority. A convincing voice on an unverified line gets no action.
The synthetic employee is caught at both ends. ScreenComply establishes, at the interview and during onboarding, that the human on the screen is real and unassisted. Monolith then treats the new identity like every other: named, owned, scoped, baselined, and contained the moment its behaviour diverges from its purpose. An insider that is not a person is governed as a machine identity, because that is what it is.
Approvals bind to actions. A human approval covers one specific action; a changed amount, a changed account or a replayed request needs approval again, outside the model, in a record nobody can edit.
It runs the campaign against you first. Current impersonation and phishing profiles are decomposed and executed against your digital twin. If the twin raises no alert, that is the finding, and the detection is written, deployed and verified before the real campaign arrives.
The full control set, from channel-origin attestation to payee-ledger holds and network-level isolation, is on stopping social engineering at the hardware layer.
Frequently asked questions
What is business email compromise?
A category of fraud in which an attacker impersonates an executive, vendor, lawyer or partner, usually by email and increasingly by voice or video, to redirect a payment, change bank details or obtain sensitive data. The FBI IC3 report records $3.04 billion in BEC losses to corporate victims in 2025.
How has superintelligence changed phishing?
It removed the signals. Lures are written in the organisation's own idiom from its public footprint, lookalike domains are registered and dressed automatically with valid certificates and passing mail authentication, and the follow-up is a cloned voice or face. Each step is cheap and parallel, so the full chain runs against thousands of targets at once.
What is a synthetic employee?
A candidate who is not a person, or is a person fronting for an operation, who passes a remote interview conducted by a superintelligent agent, is onboarded and issued credentials, and operates as an insider. ScreenComply verifies the human at interview and onboarding; Monolith governs the resulting identity as a machine identity and contains it on divergence from purpose.
Does Monolith replace email security?
No. Mail filtering remains useful against known infrastructure and templates. Monolith defends what filtering cannot: the administrative layer, the identity and attestation behind internal requests, the binding of approvals to actions, and the detection gaps found by running current campaigns against your twin.
What is administrative control in this context?
The domains, registrars, DNS, certificate authorities, mail authentication records and administrative consoles that define how the organisation presents itself and who can change that. Monolith treats them as assets to inventory, monitor and defend, because an attacker who controls them controls the organisation without compromising a single host.