What are the signs that a secure email gateway is missing compromised-account phishing?

A gateway is likely missing these attacks when low-risk scoring is applied to messages that still show suspicious context. Warning signs include a real but unusual sender, empty or odd recipient fields, reply-to mismatches, and text that elicits personal or policy details instead of obvious fraud. If the filter only tags messages as external, it may never reach a strong fraud decision.

Why Compromised-Account Phishing Slips Past a Secure Email Gateway

The most useful signal is not whether a message looks broadly external, but whether it presents a believable internal relationship while still carrying weak phishing indicators. A gateway can miss these attacks when sender reputation, message origin, or attachment scanning looks clean, yet the message is using a real account, a spoofed conversational pattern, or a subtle reply path to gain trust. That is why context beats simple block-and-tag logic.

Compromised-account phishing often starts from a legitimate mailbox, so the email can inherit normal authentication and pass basic hygiene checks. The message may still be risky if it is asking for credentials, payment detail, policy exceptions, wire changes, or other sensitive responses that a normal colleague would not request in that form. When the content is socially plausible, the gateway has to rely on weaker context clues rather than obvious malicious artifacts.

Signals that matter most are odd combinations, not single red flags. A real sender with an unusual tone, an empty or malformed recipient field, a reply-to mismatch, a request that bypasses normal process, or a message that pushes urgency without a clear business reason all deserve more scrutiny. For this reason, mailbox compromise detection is strongest when it looks at conversation pattern, recipient behavior, and the legitimacy of the ask together.

Where Gateway Filtering Usually Goes Wrong

secure email gateway often make their first decision on external reputation, URL inspection, attachment reputation, and coarse content rules. That works well for noisy commodity phishing, but it is weaker against a stolen account or a message that is only lightly modified from a real conversation. If the system treats the message as low risk because it came from a known domain or a previously trusted contact, the attacker can stay inside the normal trust boundary.

The failure mode is usually a scoring problem. A message may contain a suspicious ask, but the gateway does not accumulate enough evidence to move it from “external” or “low confidence” into a strong fraud or compromise verdict. That is especially common when the email has no malware, no obvious impersonation markers, and no brand-new infrastructure to flag. In practice, the gap is often between “technically deliverable” and “behaviorally credible.”

This is also why mailbox compromise is harder than classic spoofing. The attack is not trying to look like a random stranger; it is trying to look like a known person acting under unusual circumstances. The defender therefore needs controls that can evaluate whether the message is out of character for the sender, not just whether it is syntactically valid.

What the Warning Pattern Usually Looks Like in Practice

The strongest operational pattern is a message that seems legitimate at the transport layer but breaks down when you inspect the conversation path. Common examples include a real sender account that is asking for an unusual action, a reply chain that no longer matches the original thread, an unexpected empty To or CC field, or a reply-to address that does not belong with the sender identity. Those inconsistencies are often the first sign that the gateway is underestimating the message.

Another useful clue is content that tries to extract personal, financial, or policy details instead of asking for an obviously malicious action. Compromised-account phishing often uses low-friction prompts such as “Can you confirm this,” “Are you available,” or “Please review this quickly,” because those phrases are easier to slip past content filters and easier for recipients to answer without thinking. The danger is that the real objective appears only after the conversation starts.

At scale, the operational question is whether the email platform can correlate these weak indicators before the message reaches the user. A good program reviews sender behavior, recipient anomalies, authentication history, and historical communication patterns together, then escalates cases that are unusual for the account even when the message itself does not look overtly malicious.

Risk and Threat Considerations

Compromised-account phishing is dangerous because it abuses trust that the gateway may already consider established. Once a legitimate account is used to send the message, the attacker can blend into normal business communication and bypass many traditional anti-phishing signals, especially where the email contains no payload or obvious impersonation.

Failure mechanism: The gateway overweights ordinary deliverability signals and underweights conversation anomalies, so a real-but-compromised sender can deliver a socially engineered request without triggering a strong fraud decision.

Impact: Users are more likely to reveal credentials, approve unauthorized changes, or move money and sensitive data, while the organization loses early warning that an internal account has already been weaponized.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
MITRE ATT&CK	T1078 — Valid Accounts	Compromised-account phishing relies on legitimate access abuse.
Recommendation — Hunt for abnormal use of valid accounts and flag requests that deviate from normal sender behavior.
NIST SP 800-53 Rev 5	IA-5 — Authenticator Management	Compromised-account phishing often involves stolen or abused credentials.
	AU-6 — Audit Review, Analysis, and Reporting	Anomalous sender and reply-path behavior should be surfaced through log review.
Recommendation — Rotate and revoke exposed authenticators quickly when mailbox compromise is suspected. Correlate mail logs and account activity to detect unusual message patterns and suspicious replies.
CIS Controls v8	CIS-8 — Audit Log Management	Detection depends on reviewable mail and identity activity records.
	CIS-5 — Account Management	Mailbox compromise is fundamentally an account-use problem.
Recommendation — Centralize email and account logs so unusual message behavior can be investigated quickly. Review privileged and high-risk mail accounts for anomalous access and unusual sending behavior.

Practitioner Guidance

What to verify: Treat sender authenticity, reply-path consistency, and message context as separate checks. If a message passes reputation checks but fails conversation logic, escalate it for human review rather than relying on a single “external” label.

Common mistake: Teams often tune for obvious spoofing and malware, then assume anything that passes those tests is safe. For compromised-account phishing, the better question is whether the request matches the sender’s normal behavior and business process.

What good looks like: Analysts can quickly explain why a message was unusual, and the gateway or downstream review process can surface that explanation before the user acts on it. The most useful detections combine message content with account behavior and recipient anomalies, not content alone.

Practitioner takeaway: If your email security stack only decides whether a message is external or technically clean, it will miss the attacks that matter most; effective detection has to judge whether the request makes sense for that sender at that moment.