Legacy gateways tend to fail when phishing is delivered with delayed links, impersonation, or no-payload business email compromise. They are built to judge messages at the edge, but modern attacks often become dangerous only after delivery. That leaves security teams cleaning up inboxes after users have already interacted with messages instead of preventing exposure up front.
Where a legacy gateway stops being enough
A legacy email gateway is strongest when the threat can be judged from the message itself, for example on reputation, attachments, links, or obvious spam signals. Modern phishing often bypasses that model by looking clean at delivery time and only turning malicious after the message is opened, replied to, or used to drive an external workflow. Once the defense is only at the edge, the organisation is relying on inbox hygiene and user judgment to do work the control was never designed to do.
That shift matters because the gateway is making a point-in-time decision, while the attack is often staged over time. Delayed-link phishing, impersonation, and business email compromise can all sit quietly until the attacker has won trust, changed context, or moved the conversation to a channel the gateway no longer sees.
EmeraldWhale Git config credential theft is a good reminder that stolen access material is often leveraged after the initial lure, not inside the message that delivered it. MITRE D3FEND is useful here because it frames defense as layered countermeasures, not a single inbox checkpoint.
How delayed links and impersonation beat the edge model
Delayed-link campaigns are effective because the email itself can appear harmless until the attacker swaps in a live destination later. Impersonation works because the message may contain no malicious payload at all, only a prompt to approve, pay, reset, or share information. In both cases, the security decision happens after delivery, often when the user is already inside a trusted workflow.
This breaks a gateway-centric assumption: that the risky content is present and detectable when the message arrives. If the harmful action is deferred, or if the message is just the opening move in a conversation, the gateway may do its job correctly and still fail operationally.
Mailchimp breach 2022 shows how social engineering can be used to reach internal tools and downstream data, not just mailboxes. NIST SP 800-63 Digital Identity Guidelines is relevant because phishing-resistant authentication becomes more important once message inspection can no longer be the primary trust signal.
Dropbox GitHub breach 2022 also illustrates the pattern of an email lure leading to a broader compromise path, including repository access and secret exposure. That is exactly where a mail gateway alone becomes too narrow to contain the blast radius.
What security teams have to replace, not just add
The practical failure is not simply that the gateway misses more phish. It is that the organisation has no second line of defense that can verify intent, context, or transaction legitimacy after delivery. A stronger model combines mailbox controls, identity-aware access controls, user reporting, and response actions that can revoke tokens, quarantine messages, and kill sessions when a lure succeeds.
That means teams should treat phishing as an exposure problem across email, identity, and workflow rather than as a content-filtering problem. If a message can lead to an action with business impact, the control set has to validate the action as well as the message.
CIS Controls v8 is useful because it pushes teams toward layered safeguards, not mailbox-only reliance. NIST Cybersecurity Framework 2.0 also fits because the problem spans govern, protect, detect, respond, and recover, not just protect-at-the-edge.
OWASP Non-Human Identity Top 10 is relevant where phishing leads to secret theft, token abuse, or long-lived access that persists after the email is gone. The gateway never sees that downstream misuse, but the attacker can use it to turn a single lure into durable access.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK and OWASP Non-Human Identity Top 10 address the attack and risk surface, while CIS Controls v8, NIST SP 800-63 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1566 — Phishing | Phishing delivery and impersonation are the core attack pattern here. |
| Recommendation — Map lure variants to phishing techniques and tune detections for delayed-link and impersonation tradecraft. | ||
| CIS Controls v8 | CIS-5 — Account Management | Compromised inboxes and follow-on access depend on account control and revocation speed. |
| Recommendation — Strengthen account governance so phished access can be revoked and contained quickly. | ||
| NIST SP 800-63 | AAL3 — Phishing-Resistant Authenticator Assurance Level | Phishing-resistant authentication reduces the value of credential-harvesting lures. |
| Recommendation — Use phishing-resistant authenticators for high-value access paths and approvals. | ||
| NIST CSF 2.0 | PR.AA-05 — Identities are proofed and bound to credentials | The issue depends on trustworthy identity validation beyond email delivery. |
| Recommendation — Bind sensitive access and approvals to stronger identity assurance than email trust. | ||
| OWASP Non-Human Identity Top 10 | NHI-02 — Secret Leakage | Phishing often succeeds by stealing tokens, API keys, or other secret material. |
| Recommendation — Protect secrets so a phished user or workflow cannot expose durable access material. | ||
Practitioner Guidance
What to prioritise: Treat the biggest gap as post-delivery validation. If your current control set cannot inspect link reputation, user action, identity risk, and session state together, you do not have a complete phishing defense, only a first-pass filter.
What to verify: Check whether suspicious mail can trigger message recall, link isolation, token revocation, or forced reauthentication fast enough to matter. If the response still depends on a help desk ticket after a user clicks, the control is too slow for modern impersonation attacks.
Common mistake: Teams often measure success by the volume of mail blocked at ingress. For this threat, a better signal is how quickly the organisation detects and contains the first user interaction, because many successful lures will never look malicious until after delivery.
Practitioner takeaway: The right objective is not to make the gateway smarter than the attacker, it is to avoid making the gateway the only thing standing between a clean-looking message and a high-impact user action.
Related resources from NHI Mgmt Group
- What breaks when security teams depend on legacy email controls to stop modern AI-generated phishing?
- What breaks when public sector organizations rely on legacy email defenses against modern AI-enabled attacks?
- What are the signs that a traditional secure email gateway is no longer enough against modern phishing campaigns?
- How should security teams defend against modern email attacks that bypass legacy filters?