Doppel's AI Defense System Blocks Attacks Before They Spread

With the emergence of generative AI, attackers are instantly mass-producing phishing kits, impersonation domains, and impersonation accounts, scaling their attacks infinitely. Existing manual review methods have limits in keeping up with the speed and scope of these automated threats.

To address this, Doppel developed an autonomous social engineering defense system based on OpenAI GPT-5 and o4-mini models. This system automates the process of detecting, classifying, and blocking threats, reducing analysts' workload by 80% and improving threat processing capacity by 3x.

In particular, through Reinforcement Fine-Tuning (RFT) technology, the system improved the model's ability to learn from human feedback to make consistent and explainable decisions. This dramatically shortened response time from hours to minutes.

The LLM-based threat detection pipeline works as follows:

• Signal filtering and feature extraction: o4-mini is used to remove noise and extract structured features from millions of domains and URLs.
• Parallel threat verification: Custom GPT-5 prompts analyze brand misuse and social engineering patterns.
• Threat classification: o4-mini with RFT applied classifies threats as malicious, benign, or ambiguous.
• Final verification: A second GPT-5 stage verifies the decision and generates natural language rationale, automatically executing blocking actions when confidence exceeds the threshold.