Email remains the most exploited attack vector in cybersecurity. Despite decades of filtering technology and security awareness campaigns, attackers continue to find success through the inbox because email was never designed with security in mind. The SMTP protocol that underpins modern email dates back to 1982, built for a trusted academic network where authentication was an afterthought.
Today, over 91% of cyberattacks begin with an email. Business email compromise alone costs organizations $2.4 billion annually. Understanding how these attacks work and how to defend against them is essential for anyone responsible for organizational security.
The Email Threat Landscape
Modern email threats extend far beyond the poorly written spam of years past. Attackers use sophisticated techniques that exploit both technical vulnerabilities and human psychology. The major categories of email-based threats include:
Phishing is the broadest category, encompassing any attempt to trick recipients into revealing sensitive information, clicking malicious links, or downloading harmful attachments. Phishing emails may impersonate banks, software providers, shipping companies, or internal colleagues. The goal is to create urgency or trust that overrides the recipient's caution.
Business Email Compromise (BEC) is a targeted form of fraud where attackers impersonate executives, vendors, or trusted partners to manipulate employees into transferring funds, sharing sensitive data, or changing payment details. BEC attacks often involve no malware at all, making them invisible to traditional security tools that scan for malicious payloads.
Malware delivery uses email as a transport mechanism for ransomware, trojans, keyloggers, and other malicious software. Attachments may contain weaponized documents with macro-based payloads, or links may direct recipients to sites that exploit browser vulnerabilities or deliver drive-by downloads.
Credential harvesting directs recipients to convincing replicas of login pages for services like Microsoft 365, Google Workspace, banking platforms, or internal applications. Once attackers capture valid credentials, they can access accounts, escalate privileges, and move laterally through an organization's systems.
Account takeover occurs when attackers gain access to a legitimate email account, often through credential harvesting or password reuse. From that compromised account, they can launch attacks that bypass many security controls because the emails originate from a trusted, authenticated source.
How Modern Phishing Attacks Work
Phishing has evolved from mass-distributed "Nigerian prince" scams into highly targeted operations that can fool even security-conscious recipients. Understanding the mechanics of modern phishing is the first step toward defending against it.
Spear Phishing
Unlike bulk phishing campaigns, spear phishing targets specific individuals or small groups within an organization. Attackers research their targets using LinkedIn profiles, company websites, social media, and previously breached data. They craft messages that reference real projects, use correct internal terminology, and mimic the communication style of known contacts.
A spear phishing email might reference a recent company acquisition, mention a specific software platform the target uses, or follow up on a conference the target attended. This personalization dramatically increases success rates compared to generic phishing.
AI-Generated Phishing
Large language models have eliminated the grammatical errors and awkward phrasing that once served as reliable indicators of phishing emails. Attackers now use AI to generate messages that are fluent, contextually appropriate, and tonally consistent with legitimate business communication.
AI also enables attackers to scale personalization. Rather than manually researching each target, automated tools can scrape public information and generate customized phishing messages for thousands of recipients, each with unique personalization that would previously have required manual effort.
Brand Impersonation
Attackers frequently impersonate well-known brands by replicating email templates, logos, and formatting used by companies like Microsoft, Google, Amazon, DHL, and major banks. These emails typically warn of account suspension, unusual activity, or pending deliveries to create urgency.
Modern brand impersonation goes beyond visual similarity. Attackers register lookalike domains (such as "rnicrosoft.com" using "rn" instead of "m"), use legitimate email marketing platforms to send messages, and even host phishing pages on trusted infrastructure like Azure, AWS, or Google Cloud to bypass URL reputation checks.
QR Code Phishing (Quishing)
A newer technique involves embedding malicious QR codes in emails. Because QR codes direct users to URLs through their phone cameras, they bypass many email security tools that only scan hyperlinks in the message body.
Business Email Compromise: A Deep Dive
BEC deserves special attention because it represents the single most financially damaging form of email-based attack. Unlike malware or ransomware, BEC attacks rely purely on social engineering, which means they leave no malicious payload for security tools to detect.
Types of BEC Attacks
CEO fraud involves impersonating a senior executive to request urgent wire transfers or sensitive information from finance or HR staff. The attacker may register a lookalike domain or compromise the executive's actual account, then send requests that appear to come from the CEO or CFO.
Vendor impersonation targets accounts payable departments by impersonating known suppliers. Attackers send emails requesting a change in banking details for future payments, then intercept funds when the next legitimate invoice is paid to the fraudulent account.
Attorney impersonation exploits the authority and confidentiality associated with legal matters. Attackers pose as external counsel handling a sensitive deal, pressuring targets to act quickly and discreetly, bypassing normal approval processes.
Payroll diversion targets HR departments with requests to change an employee's direct deposit information. The attacker impersonates the employee, and the next paycheck is routed to an account controlled by the attacker.
How Attackers Gain Access
BEC attackers typically gain their foothold through one of several methods:
- Credential phishing — A targeted phishing email captures an executive's email password, giving the attacker direct access to their mailbox.
- Password spraying — Attackers try commonly used passwords against multiple accounts, hoping to find one that works, especially on accounts without multi-factor authentication.
- Dark web purchases — Credentials from previous breaches are sold on underground marketplaces. If an executive reused their password, attackers can access their email directly.
- Lookalike domains — Rather than compromising an actual account, attackers register domains that closely resemble the target organization's domain and send emails from those addresses.
The Financial Impact
The average BEC loss per incident is approximately $125,000, but individual cases regularly reach into the millions. In 2023, a multinational firm lost $25 million after an employee participated in a video call with deepfake recreations of the company's CFO and other executives, all orchestrated through an initial BEC email. Recovery rates for BEC wire fraud are typically under 30%, because funds are quickly moved through multiple accounts across international borders.
Email Authentication Protocols: SPF, DKIM, and DMARC
Email authentication protocols are the technical foundation of email security. They work together to verify that emails actually come from the domains they claim to represent, making it harder for attackers to spoof trusted identities.
SPF (Sender Policy Framework)
SPF allows domain owners to publish a DNS record listing the IP addresses and servers authorized to send email on behalf of their domain. When a receiving mail server gets a message claiming to be from "example.com," it checks the SPF record to verify that the sending server is authorized.
SPF has limitations. It only validates the "envelope from" address (the return-path), not the "header from" address that users actually see. This means an attacker can spoof the visible sender address while passing SPF checks with a different envelope address. SPF also breaks when emails are forwarded, because the forwarding server's IP won't be listed in the original domain's SPF record.
DKIM (DomainKeys Identified Mail)
DKIM adds a cryptographic signature to outgoing emails. The sending server signs the message using a private key, and the corresponding public key is published in the domain's DNS records. Receiving servers can verify the signature to confirm that the message hasn't been tampered with and that it was authorized by the domain owner.
DKIM survives email forwarding because the signature is attached to the message itself, not tied to the sending server's IP address. However, DKIM alone doesn't tell receiving servers what to do with messages that fail verification.
DMARC (Domain-based Message Authentication, Reporting and Conformance)
DMARC ties SPF and DKIM together and adds a critical policy layer. A DMARC record tells receiving servers what to do when a message fails authentication: monitor only (p=none), quarantine it (p=quarantine), or reject it outright (p=reject).
Crucially, DMARC checks "alignment," ensuring that the domain in the visible "From" header matches the domain validated by SPF or DKIM. This closes the gap that allowed attackers to pass SPF while spoofing the visible sender.
DMARC also provides reporting. Domain owners receive aggregate reports showing who is sending email using their domain, including legitimate services and unauthorized sources. These reports are invaluable for identifying shadow IT (unauthorized SaaS tools sending email as your domain) and active spoofing campaigns.
How They Work Together
The three protocols form a layered defense:
- SPF verifies the sending server is authorized.
- DKIM verifies the message hasn't been altered and was signed by the domain.
- DMARC enforces policy when either check fails and requires alignment with the visible sender address.
An organization with DMARC set to "reject" and properly configured SPF and DKIM records makes it extremely difficult for attackers to send emails that appear to come from their domain. However, these protocols only protect against domain spoofing of your own domain. They don't prevent attackers from using lookalike domains or compromised accounts.
Secure Email Gateways vs. Integrated Cloud Email Security
Organizations have two primary architectural approaches to email security, each with distinct advantages and trade-offs.
Secure Email Gateways (SEGs)
Secure email gateways sit in front of your email system, intercepting and scanning all inbound (and often outbound) email before it reaches user inboxes. They act as a checkpoint, analyzing messages for malware, phishing indicators, spam, and policy violations.
SEGs have been the traditional approach to email security for over two decades. They offer deep content inspection, sandboxing capabilities (detonating suspicious attachments in isolated environments), and URL rewriting that checks links at the time of click rather than just at delivery.
The main drawback of SEGs is that they require MX record changes to route email through the gateway, which adds latency and creates a visible security layer that attackers can probe. SEGs also have limited visibility into internal email traffic.
Integrated Cloud Email Security (ICES)
Integrated solutions connect directly to email platforms like Microsoft 365 or Google Workspace via API. Rather than sitting inline, they analyze messages after delivery and can retroactively remove threats discovered later. They also monitor internal emails, detect account compromise through behavioral analysis, and provide context about communication patterns.
API-based solutions are invisible to attackers since there are no MX record changes to reveal their presence. They can also analyze the full context of email conversations, detecting anomalies like unusual requests, first-time senders impersonating known contacts, or changes in communication patterns that might indicate a compromised account.
The trade-off is that API-based solutions analyze messages post-delivery, meaning there's a brief window where a malicious email may sit in a user's inbox before being removed. Some solutions mitigate this with near-real-time scanning, but the inherent architecture means they're reactive rather than preventive.
Which Approach Is Right?
Many organizations use both approaches in a layered strategy. A SEG handles the bulk of known threats at the perimeter, while an API-based solution provides deeper analysis, catches what slips through, and monitors for internal threats and account compromise. The right choice depends on your email platform, budget, compliance requirements, and risk tolerance.
Email Security Best Practices for Organizations
Technical controls are necessary but insufficient on their own. A comprehensive email security posture combines technology, policy, and process.
Authentication and Access Control
- Enforce multi-factor authentication (MFA) on all email accounts. MFA is the single most effective control against account takeover, blocking over 99% of automated credential attacks.
- Implement conditional access policies that restrict email access based on device compliance, location, and risk level.
- Disable legacy authentication protocols like POP3, IMAP, and SMTP AUTH where possible, as these don't support MFA and are frequent targets for brute force attacks.
- Use strong, unique passwords and consider passwordless authentication methods where your platform supports them.
Email Configuration
- Deploy SPF, DKIM, and DMARC with DMARC set to at least "quarantine" and working toward "reject." Monitor DMARC reports to identify unauthorized senders.
- Enable external sender warnings that flag emails from outside your organization, making it harder for attackers to impersonate internal colleagues.
- Configure anti-spoofing rules to detect messages where the display name matches an internal employee but the email address is external.
- Implement email encryption for sensitive communications, using TLS at a minimum and end-to-end encryption for highly confidential data.
Data Protection
- Deploy data loss prevention (DLP) rules that detect and block sensitive information like credit card numbers, social security numbers, or health records from being sent via email.
- Restrict auto-forwarding to external addresses. Attackers who compromise an account often set up mail forwarding rules to maintain access even after the password is changed.
- Audit mailbox rules regularly to detect suspicious forwarding, deletion, or filtering rules that may indicate compromise.
Employee Training and Phishing Simulation Programs
Technology catches most threats, but the remaining few percent that reach inboxes are typically the most sophisticated. Trained employees serve as the last line of defense.
Effective Security Awareness Training
The most effective training programs share several characteristics:
Frequency matters more than duration. Short, monthly training sessions are more effective than annual hour-long compliance exercises. People retain information better through regular reinforcement.
Use real examples. Generic training about "not clicking suspicious links" is far less effective than showing employees actual phishing emails that targeted your organization or industry. When people see threats relevant to their daily work, the lessons stick.
Make reporting easy. Implement a one-click reporting button in your email client (most major platforms support this). If reporting a suspicious email takes more than 10 seconds, people won't do it. Acknowledge reports quickly so people know their effort matters.
Avoid blame culture. If employees fear punishment for clicking a phishing link, they won't report incidents. Frame training as skill-building rather than testing, and treat clicks on simulated phishing as learning opportunities rather than failures.
Phishing Simulations
Regular phishing simulations serve two purposes: they measure organizational resilience and provide realistic training. Effective simulation programs follow these principles:
- Start with baseline measurement before training begins, so you can quantify improvement over time.
- Vary the difficulty of simulations. Not every test should be a sophisticated spear phish. Include a range from obvious to subtle.
- Rotate scenarios to cover different attack types: credential harvesting, malware delivery, BEC, voice phishing (vishing) pretexts, and QR code attacks.
- Deliver training immediately after a click. The moment someone interacts with a simulated phish is the most teachable moment.
- Track trends, not individuals. Department-level metrics are more useful than singling out individuals, which creates resentment and discourages reporting.
Incident Response for Email-Based Attacks
Even with strong defenses, some attacks will succeed. Having a documented, rehearsed incident response plan for email security incidents dramatically reduces the damage.
Immediate Containment Steps
When a phishing attack or account compromise is detected:
- Isolate the affected account by resetting the password and revoking all active sessions. If MFA wasn't enabled, enable it immediately.
- Check for mailbox rules that the attacker may have created, particularly forwarding rules, deletion rules, or rules that move specific messages out of the inbox.
- Search for and remove related messages across all mailboxes. If one person received a phishing email, others likely did too. Use your email security platform's threat hunting capabilities to find and purge related messages.
- Review sign-in logs to determine when the compromise occurred, what was accessed, and whether the attacker moved laterally to other systems.
- Check for data exfiltration by reviewing sent items, file sharing activity, and any connected applications that the compromised account had access to.
Investigation and Recovery
After containment, conduct a thorough investigation:
- Determine the attack vector. Was it a phishing email, credential stuffing, or another method? Understanding how the attacker got in prevents recurrence.
- Assess the blast radius. What data was accessible? Were other accounts compromised? Did the attacker send emails from the compromised account?
- Notify affected parties if sensitive data was exposed. Regulatory requirements (GDPR, HIPAA, state breach notification laws) may mandate notification within specific timeframes.
- Preserve evidence for potential law enforcement involvement, particularly for BEC cases involving financial loss.
- Update defenses based on lessons learned. If the attack exploited a gap in your security controls, close it.
Evaluating Email Security Solutions
Choosing an email security solution requires looking beyond marketing claims. Here are the criteria that matter most:
Detection Capabilities
- Multi-layered analysis that combines reputation checks, content analysis, behavioral analysis, and sandboxing. No single technique catches everything.
- Time-of-click URL protection that re-evaluates links when they're clicked, not just when the email is delivered. Attackers frequently use delayed detonation, where a URL is clean at delivery time but becomes malicious hours later.
- BEC detection that analyzes communication patterns, sender behavior, and message intent rather than just scanning for malware or known bad URLs.
- Attachment sandboxing that detonates files in isolated environments to detect zero-day malware that signature-based scanning misses.
Operational Features
- Automated remediation that can remove malicious emails from all inboxes after delivery, not just block them at the gateway.
- Integration with your email platform through native APIs rather than requiring complex mail flow modifications.
- Granular policy controls that let you apply different security levels to different user groups based on their risk profile.
- Clear reporting and analytics that help you understand your threat landscape and demonstrate security posture to leadership.
Vendor Considerations
- Threat intelligence sources. Where does the vendor get their threat data? How quickly do they incorporate new indicators of compromise?
- False positive rates. Overly aggressive filtering that blocks legitimate email is a security solution that people will work around.
- Total cost of ownership including licensing, implementation, ongoing management, and the staff time required to operate the solution.
- Support and response times. When a critical incident occurs, how quickly can you reach a knowledgeable human?
Common Email Security Mistakes
Even organizations that invest in email security often leave gaps that attackers exploit. Recognizing these common mistakes helps avoid them.
Relying solely on native email platform security. Microsoft 365 and Google Workspace include basic email security, but their primary business is productivity software, not security. Built-in protections are a starting point, not a complete solution. The most sophisticated attacks are specifically designed to bypass these default controls.
Deploying DMARC at "none" and never progressing. Many organizations implement DMARC in monitoring mode but never move to enforcement. A DMARC policy of "none" provides visibility into spoofing but does nothing to prevent it. The goal should be reaching "reject" within a reasonable timeframe.
Ignoring internal email threats. Most email security focuses on inbound messages from external senders. But once an attacker compromises an internal account, they can send emails that bypass many security controls. Monitoring internal email traffic is essential for detecting account compromise and lateral movement.
Treating email security as a one-time project. Email threats evolve constantly. Security configurations, policies, and training need continuous updates. An email security posture that was adequate six months ago may have significant gaps today.
Excluding executives from security controls. Senior executives are the most targeted individuals in an organization but sometimes receive exemptions from security policies due to convenience preferences. Executives should receive the strongest protections, not the weakest.
Neglecting mobile email security. Many employees access email on personal devices that lack corporate security controls. Mobile device management (MDM) or conditional access policies that verify device compliance are necessary to close this gap.
Overlooking email forwarding rules. Attackers who compromise an account frequently set up forwarding rules to maintain access to incoming emails even after the password is changed. Regular audits of mailbox rules should be part of any email security program.
Failing to test incident response. A plan that has never been tested through tabletop exercises or simulations will fail under the pressure of an actual incident. Regular practice builds the muscle memory needed for effective response.
Moving Forward
Email security is not a problem that can be solved once and forgotten. The threat landscape shifts continuously as attackers develop new techniques and organizations adopt new workflows. The organizations that maintain strong security treat it as an ongoing discipline: regularly reviewing technical controls, updating policies, training people, and testing response capabilities.
Start by assessing your current posture. Are SPF, DKIM, and DMARC properly configured and enforced? Is MFA enabled on all accounts? Do you have visibility into internal email threats? Can you detect and respond to BEC attempts?
No organization can eliminate email risk entirely, but a layered approach combining authentication protocols, advanced threat detection, access controls, employee training, and practiced incident response can reduce that risk to manageable levels.