City email security uses AI to cluster look-alike messages that target payroll clerks with fake direct-deposit changes. What security-task capability is the model providing?

In municipal email security operations, pattern recognition is the AI capability that clusters messages sharing narrative structure, sender-impersonation tactics, and objective (here, fake direct-deposit changes aimed at payroll clerks) so analysts treat the activity as a campaign rather than fifty unrelated tickets. That clustering lets the city prioritize one containment playbook—block indicators, warn payroll, validate deposit-change workflows—while preserving evidence of how the lure evolved across wrappers. Behavioral analytics that groups similar phishing messages into campaigns misnames the capability; behavioral analytics baselines user or account activity to spot anomalous actions, it does not cluster message content into campaigns. Automated response that groups similar phishing messages into campaigns confuses analysis with action; automated response executes containment after detection, it does not perform the clustering of look-alike messages itself. Language generation that groups similar phishing messages into campaigns misattributes clustering to content creation; language generation drafts human-readable text, it does not group look-alike deposit scams into campaigns. Exam caveat: SecAI+ items often contrast genuine AI security tasks (pattern recognition, triage assistance) with adjacent security capabilities that serve a different purpose—pick the capability that groups similar indicators, not the option that mislabels that grouping as behavioral analytics, automated response, or language generation. Operational check: after clustering, require human confirmation before mass user notifications, retain original messages for forensics, and verify that payroll deposit-change processes still demand dual control independent of email content.