How should teams balance pre-delivery filtering with post-delivery detection?

They should treat pre-delivery filtering as one layer, not the control boundary. AI-driven phishing often needs post-delivery monitoring, mailbox telemetry, and response workflows because some malicious messages will reach the inbox before the behaviour becomes obvious.

Why pre-delivery filtering is only the first control layer

Pre-delivery filtering is valuable, but it is a probability reducer, not a guarantee. In phishing and other message-borne abuse, the real decision point is whether the organisation can still recognise and contain the message after it has reached the inbox, been previewed, or triggered a user action. That is why filtering, user reporting, mailbox telemetry, and response workflows have to work together.

Teams should think in terms of layered control, not a single gate. Pre-delivery controls catch known bad content, but post-delivery controls cover messages that evade reputation, syntax, or brand checks, and they provide the evidence needed to trace exposure once delivery has occurred.

What post-delivery detection adds that filtering cannot

Post-delivery detection looks for behavioural signals after receipt, including unusual sender patterns, link clicks, mailbox rule changes, suspicious forwarding, and correlated user reports. That matters because many malicious messages are only obviously hostile after interaction or after they begin to influence account behaviour. MITRE D3FEND is useful here because it frames detection as a defensive activity that maps to observable countermeasures, not just message blocking.

This layer also improves response speed. If a message bypasses filters, teams still need telemetry that shows who received it, who opened it, what links were accessed, and whether the mailbox or session was altered. Those signals turn a vague suspicion into a containment decision, such as purge, quarantine, reset, or investigation.

How to balance prevention, visibility, and response

The practical balance is to set filtering to reduce volume, then invest in visibility to catch the residual risk. Security teams should optimise for the combined outcome, fewer malicious messages delivered and faster detection when one does arrive. SANS Security Resources is a useful reference point for the operational side of that balance, especially detection engineering and incident handling.

The best operating model is measured, not assumed. If pre-delivery filtering is strong but post-delivery telemetry is weak, the organisation has created a blind spot: lower volume of inboxed threats, but slower response when a bypass occurs. If post-delivery detection is strong but filtering is weak, analysts are forced to triage too much noise. The goal is a workable division of labour between prevention, detection, and response.

What good looks like in practice

A mature setup has clear handoffs: filters reduce commodity spam, mailbox analytics surface suspicious delivery and user interaction, and response playbooks define what happens next. Teams should be able to answer three questions quickly: did the message arrive, who interacted with it, and what containment action is required? That is the point where detection becomes operational, not just informational.

For engineering and SOC teams, the useful test is whether a bypassed message can still be found, attributed, and remediated before it becomes an account compromise or lateral movement issue. If the answer depends entirely on user reporting, the balance is too far toward pre-delivery filtering and not far enough toward post-delivery control.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
MITRE ATT&CK	T1566 — Phishing	Phishing delivery and user interaction drive the need for layered detection and response.
	T1114 — Email Collection	Mailbox telemetry and post-delivery monitoring depend on observing message access and collection activity.
Recommendation — Map inbox abuse to T1566 and tune detections for delivery, clicks, and follow-on compromise. Hunt for mailbox access and message collection signals after delivery.
CIS Controls v8	CIS-8 — Audit Log Management	Post-delivery detection depends on mailbox and response telemetry that is logged and retained.
	CIS-17 — Incident Response Management	The question is partly about the response workflow required after filtering misses a malicious message.
Recommendation — Centralize and retain mailbox and incident logs so suspicious delivery can be investigated. Define and test playbooks for quarantine, purge, and user-impact assessment.
NIST CSF 2.0	DE.CM-09 — Vulnerabilities Are Monitored and Responded To	Continuous monitoring is the control principle behind catching threats after delivery.
Recommendation — Monitor mail and endpoint signals continuously so missed messages still trigger action.

Practitioner Guidance

What to prioritise: Build the post-delivery workflow before assuming filtering is sufficient. Mailbox telemetry, alerting, and response ownership matter most when the first layer misses.

What to verify: Confirm that analysts can trace message delivery, user interaction, and mailbox changes from a single incident record. If they cannot, the control set is fragmented.

Decision rule: If a message can still reach the inbox and trigger user action, treat detection and response as part of the control boundary, not as optional follow-up.

Practitioner takeaway: The right balance is not “filter more” or “detect more”, it is to make sure every message that slips through can still be seen, scoped, and contained quickly.