Email compromise

Email compromise is the takeover or abuse of a mailbox so an attacker can act through a trusted communication channel. In identity terms, it matters because mail often carries resets, approvals, and recovery signals that can be used to extend access beyond the inbox itself.

Expanded Definition

Email compromise is not just stolen access to a mailbox. In NHI and IAM operations, it is a trust pivot: the attacker uses the mailbox as a control plane for password resets, approval workflows, vendor communications, and recovery notifications. That makes it materially different from ordinary account abuse because the mailbox often sits upstream of other identities and services.

Definitions vary across vendors on whether this term includes pure credential theft, session hijacking, forwarding-rule abuse, or full mailbox takeover. In practice, security teams should treat any unauthorized ability to read, send, search, or redirect mail as email compromise, especially when the mailbox can influence privileged access or recovery paths. The concept overlaps with business email compromise, but the governance risk is broader because automation, service accounts, and human accounts may all depend on mail for trust signals.

For background on why mailbox trust becomes a security dependency, see the Ultimate Guide to NHIs — Why NHI Security Matters Now and the CISA Business Email Compromise guidance. The most common misapplication is treating email compromise as an endpoint-only incident, which occurs when mailbox access is investigated without checking whether resets, approvals, or federation flows were also abused.

Examples and Use Cases

Implementing controls for email compromise rigorously often introduces friction in daily operations, requiring organisations to weigh faster recovery and collaboration against tighter authentication, review, and routing controls.

• An attacker gains mailbox access and uses password reset links to take over a cloud admin account, turning a single inbox into a broader identity compromise.
• A compromised executive mailbox sends approval emails for payment or procurement actions, exploiting internal trust in message origin and tone.
• A service mailbox used for alerts and recovery notifications is silently forwarded to an external address, creating persistent visibility into security events.
• A phishing campaign steals a session token from webmail, bypassing a password reset entirely and preserving access until the session is revoked.
• Mail-driven recovery for a privileged NHI is abused because the inbox is treated as a legitimate recovery factor rather than a high-value identity asset.

Mailbox abuse patterns are consistent with attacker behaviour documented in The 52 NHI breaches Report, and the speed of credential abuse highlighted in the DeepSeek breach shows why delay matters. For standards context on email authentication and integrity, RFC 5322 defines message format, while mailbox controls should also align with identity assurance practices from NIST SP 800-63.

Why It Matters in NHI Security

Email compromise is dangerous in NHI security because mail often bridges human and non-human trust. A mailbox can be the notification channel for token issuance, the recovery path for a shared service account, or the human approver behind a privileged workflow. Once compromised, the attacker can move laterally without immediately triggering classic perimeter alerts.

NHIMG research on secrets governance shows that organisations maintain an average of 6 distinct secrets manager instances, a fragmentation pattern that weakens centralized control and makes mail-based recovery abuse harder to detect and contain. That matters because email compromise and secret exposure often reinforce each other: one opens the door, the other keeps it open. The issue is also consistent with the wider threat picture described in the Anthropic AI-orchestrated cyber espionage report, where identity abuse and automation shorten the path from foothold to impact.

Organisations typically encounter the full consequence only after a reset chain, forwarding rule, or approval trail has been abused, at which point email compromise becomes operationally unavoidable to address.

Related resources from NHI Mgmt Group

• Why do compromised email accounts still create business email compromise risk?
• Who is accountable when a trusted cloud identity is used for business email compromise?
• Who is accountable when compromised cloud identity is used for business email compromise?
• How can organisations reduce the identity impact of email compromise?