A security team deploys a new AI-powered email security gateway. After two weeks, they notice it is blocking significantly more marketing emails from legitimate vendors than the previous rule-based system. What is the most likely root cause, and what is the appropriate remediation?

• A.The ML model may have learned that certain email patterns common to legitimate marketing emails (bulk sending infrastructure, unsubscribe links, tracking pixels) also appear in phishing emails in its training data, creating a high false positive rate for marketing email; remediation is creating an allow-list for known-good sender domains and retraining with correctly labeled marketing email samples
• B.The AI system is working as intended; marketing emails are a security risk and should be blocked
• C.The previous rule-based system was missing phishing attempts disguised as marketing emails
• D.Increase the detection threshold across all email categories to reduce the false positive rate