GPT-5 helps Doppel stop phishing attacks in minutes, not hours

The old model for fighting online impersonation is dead. When attackers can use generative AI to spin up hundreds of phishing domains and deepfake accounts in seconds, a team of human analysts manually reviewing each one isn’t just inefficient — it’s a liability. Doppel, a company built to defend organizations from these exact threats, saw the writing on the wall and rebuilt its entire detection stack around OpenAI’s latest models.

Kevin Tian, Doppel’s CEO, put the challenge bluntly: “The ability to generate infinite persuasion at almost no cost changed everything.” The damage from a single impersonation site can unfold in minutes as it spreads across social channels, long before a human analyst could even open their queue. The company’s response was a new defense system powered by GPT-5 and o4-mini that automates the entire process from signal triage to enforcement. The results are stark: an 80% reduction in analyst workflows and a tripling of their threat-handling capacity.

The secret sauce isn’t just faster inference. It’s a training method called reinforcement fine-tuning (RFT). Doppel took years of its own analysts’ decisions — labeling domains as malicious, benign, or ambiguous — and turned them into graded examples. Working with OpenAI’s applied engineering team, they built grader functions that reward the model not just for being right, but for explaining its reasoning clearly. “One real benefit that came out of RFT is you’re making that model’s decisions more consistent,” the team noted, solving the classic problem of two analysts looking at the same threat and reaching different conclusions.

Here’s what a single threat now looks like inside Doppel’s pipeline: after ingesting millions of signals daily, o4-mini filters out the junk. Multiple GPT-5 prompts then analyze what’s left in parallel, checking for impersonation risk and social engineering patterns. The RFT-tuned o4-mini synthesizes those findings into a classification. A second GPT-5 pass validates the call and writes a justification. If the model is confident, enforcement kicks off automatically. If it’s unsure, a human gets it — and that human’s judgment becomes tomorrow’s training data. It’s a closed loop where the machine gets smarter every time an analyst weighs in, making the entire system faster and more reliable with each attack.