The risk that mailbox rules, forwarding settings, or delegate permissions can keep moving messages after identity access should have ended. It is a lifecycle problem, not just an email configuration issue, because the control failure is persistence of data flow after account disablement.
Expanded Definition
Mailbox routing exposure describes a state where email continues to be redirected, copied, or delegated after the person or service account that created the rule should no longer control it. In NHI and IAM operations, the issue is not the mailbox itself but the persistence of message flow across identity lifecycle events such as offboarding, role changes, credential rotation, or service account retirement.
This term overlaps with email security, identity governance, and privileged access review, but it is more specific than generic forwarding risk. A mailbox can be exposed through inbox rules, transport rules, automatic forwarding, shared mailbox delegates, or OAuth-connected mail clients that still hold access. Industry usage is still evolving, so some teams treat this as an email hygiene problem while others map it to identity persistence and data exfiltration risk. The NHI lens matters because mail routing often survives even when the human or machine identity that enabled it has been disabled. For deeper context on why lingering access paths become security debt, see Ultimate Guide to NHIs — Why NHI Security Matters Now and the The State of Secrets in AppSec research on persistence and remediation gaps. The closest standards language comes from NIST digital identity guidance and NIST Cybersecurity Framework 2.0, which both emphasize lifecycle control and access governance.
The most common misapplication is treating forwarding as a one-time configuration check, which occurs when offboarding does not include rule, delegate, and token review.
Examples and Use Cases
Implementing mailbox routing controls rigorously often introduces operational friction, because teams must balance fast offboarding against the risk of breaking legitimate shared workflows or escalation paths.
- A departed employee’s inbox still forwards customer emails to a personal address because the rule was never removed during account disablement.
- A shared service mailbox continues routing alerts to a former engineer’s delegate access, even after role separation and credential revocation.
- A compromised AI agent with mail access uses hidden inbox rules to divert approvals and incident notifications away from defenders, a pattern aligned with the broader identity abuse concerns discussed in LLMjacking: How Attackers Hijack AI Using Compromised NHIs and the Anthropic report on AI-orchestrated cyber espionage.
- A finance mailbox maintains an auto-forward rule to an archived address, creating silent retention and potential leakage of invoices, resets, and approvals.
- An IT support mailbox uses transport rules to copy mail to a compliance archive, but the archive connector remains active after the business need ends.
Why It Matters in NHI Security
Mailbox routing exposure matters because it turns an identity event into a data persistence event. When access is revoked but routing remains intact, the organization may falsely believe containment has occurred while messages, reset links, and approvals continue to move. That creates direct exposure for secrets, account recovery workflows, and privileged operations. In NHI programs, this is especially dangerous because machine identities and service mailboxes often outlive the people who created them, and no single owner is left to notice stale routing.
NHIMG research on the 52 NHI Breaches Analysis shows how often identity persistence becomes a breach multiplier, and the remediation lag highlighted in The State of Secrets in AppSec reinforces how long dangerous conditions can remain unnoticed. The right governance response is to treat routing rules, delegates, forwarding targets, and connected clients as lifecycle-managed entitlements, not incidental mail settings. Organisations typically encounter the operational impact only after a missed revocation or suspicious data movement, at which point mailbox routing exposure becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST SP 800-63, NIST Zero Trust (SP 800-207) and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 | Covers improper secret and access persistence that enables mailbox routing leakage. |
| NIST CSF 2.0 | PR.AC-4 | Least privilege and access revocation apply when mail routing survives account changes. |
| NIST SP 800-63 | Digital identity lifecycle guidance supports revocation and reassessment of lingering access. | |
| NIST Zero Trust (SP 800-207) | Zero trust requires continuous verification of access paths, including email routing paths. | |
| NIST AI RMF | AI risk management applies when agentic systems can read or route messages autonomously. |
Continuously attest mailbox delegates and forwarding targets instead of assuming disablement is enough.
