Abnormal AI vs Proofpoint vs Mimecast on catching email fraud with no links or attachments

Been comparing these three after a near miss with a vendor impersonation attempt. Proofpoint and Mimecast handles known threats well, malicious links, bad attachments, that part seems to work.

Text-only fraud is where now we start having a difference. Wire transfer requests, payroll diversion, vendor impersonation written to look exactly like legitimate communication. Nothing for a signature based filter to catch. Abnormal builds a behavioral baseline for how people actually communicate and flags anything that deviates from that pattern. Proofpoint and Mimecast were not built for that attack category.

Anyone else had to rethink their email security setup after a close call like this?