In my previous blog, I explained why intent-based detection is the future of email security—moving beyond just analyzing payloads and keywords to understanding the purpose and meaning behind an email.
But there's another challenge that often goes unnoticed: multilingual attacks.
Outside the U.S., it’s common to see sentences like:
For native speakers, these mixed-language messages feel completely normal. But for traditional email security tools, they're a nightmare.
Traditional email security struggles to interpret these multilingual messages, as most solutions rely on translation-based analysis that strips away context and intent—leaving enterprises vulnerable to phishing and Business Email Compromise (BEC) attacks.
Cybercriminals know that security tools rely on keyword and payload-based detection. They actively exploit this by:
A business user in Germany receives this email:
Why It Works:
A finance employee in India receives an email from a spoofed executive:
"Arre Rajiv, urgent hai! Can you approve this wire? Mujhe 5 lakh INR transfer karna hai immediately."
Why It Works:
A U.S. company working with an Israeli vendor gets an invoice fraud email:
"Shalom David, please check this invoice. אני צריך אישור דחוף. Call me if you have questions."
Why It Works:
AI understands languages natively—retaining purpose and meaning.
Many email security solutions develop signatures[1] for each of the languages which then is used for deriving a verdict. The problem with that approach is that maintaining separate signatures for each language does not scale effectively. It leads to a growing maintenance burden and requires developing new signatures every time a new language is introduced or modified.
Every incoming email is first scanned to detect its language using n-gram analysis (LangDetect) and word2vec models (FastText library). If the detected language is Hindi, German, French, Spanish, Chinese, Korean, or Arabic, we apply intent-preserving translation into English using LLMs with fine-tuned parameters — ensuring that semantic and thematic context is retained.
Unlike legacy tools that rely on signatures[1] for each of the language keyword-based detection, Neural Analysis and Correlation Engine (NACE™) analyzes the full context post-translation, ensuring intent is captured, independent of language, which then is used as a feature set for decision making.
When attackers blend languages within a single email to bypass security tools, legacy security struggles, because it relies on separate language models, as signature sets for English and non-English text. But phishing doesn’t work that way.
NACE™, our Intent-based Threat Prevention™ AI platform, uses intent-preserving translation to convert all text into English, enabling a unified understanding of the email’s purpose. This allows NACE™ to detect malicious intent—like a wire transfer approval request disguised as a BEC phishing attempt—across multiple languages simultaneously, even when languages are mixed.
AI Detects Social Engineering Cues Beyond Just Words
Phishing emails aren’t just about words—they rely on psychological manipulation to succeed. This requires the model to be able to able to understand tone, sentiment, emotions in an email.
Attackers exploit:Intent-preserving translation in NACE™ ensures that emotion, tone, and sentiment are retained when text is converted to English. This enables our Intent-Based Detection™ to extract and leverage these subtle signals—regardless of language—allowing it to identify social engineering threats that traditional models often miss.
Final Thought: AI-Powered Security Must Speak the Language of Threats
Cybercriminals move fast, and multilingual phishing is becoming a key evasion technique to bypass legacy email security.
In an AI-powered threat landscape, security must be just as advanced.
References
[1] Multi Lingual Rules for SPAM Detection , https://scispace.com/pdf/multilingual-rules-for-spam-detection-20kubohmlu.pdf