TL;DR: Modern phishing and BEC increasingly exploit identities, relationships, and context rather than malicious payloads, and static training or rule-based controls are no longer enough, according to Abnormal AI. The governing problem is that email security now depends on correlating identity risk across collaboration systems, OAuth apps, and user behavior, not on filtering messages alone.
At a glance
What this is: This article argues that email security now depends on identity risk modeling, because modern phishing and BEC abuse relationships, behaviour, and SaaS access rather than obvious malicious payloads.
Why it matters: IAM, NHI, and security teams need to treat email as an identity control surface, since compromise often starts with account misuse, risky OAuth apps, or misconfigured mailbox permissions.
Context
Email security has moved from message inspection to identity and relationship inspection. When attackers use trusted accounts, vendor patterns, or context-aware language, simple filtering rules no longer capture the risk that matters.
For IAM practitioners, the important shift is that email now behaves like a cross-platform identity problem. The controls in scope include user behaviour baselines, collaboration telemetry, OAuth app risk, mailbox permissions, and the trust graph around vendors and internal users.
Key questions
A: Security teams should treat identity theft as a control problem, not just a user-awareness problem. Strong email filtering, phishing-resistant authentication, least privilege, and rapid credential revocation all matter. Organisations also need monitoring for unusual account activity, because stolen identities are often used quickly for fraudulent transfers, benefits claims, and account takeover before victims can respond.
Q: Why do compromised identities matter so much in email security?
A: Because a trusted account can move from email into collaboration tools, SaaS apps, and financial workflows without triggering the same suspicion as an external attacker. Once the identity is compromised, the attacker can impersonate internal trust, making identity correlation more valuable than message-only inspection.
Q: What are the signs that email threat controls are missing lateral phishing and internal abuse?
A: Common signs include suspicious messages sent from legitimate internal addresses, unexpected forwarding rules, abnormal file access after sign-in, and reports of mail that looks normal at first but becomes suspicious in sequence with other account activity. If controls only inspect inbound messages, they will miss trusted-sender abuse and internal phishing that originates inside the tenant.
Q: Should organisations treat phishing awareness as a control or an influence factor?
A: It should be treated as a supporting control, not the primary defence. Static awareness training has limited impact against AI-driven, context-aware fraud, so organisations need adaptive simulations, telemetry-backed measurement, and technical detection that can validate whether users and systems are actually changing behaviour.
Technical breakdown
Why identity baselines matter more than message signatures
Traditional email security looks for known bad indicators such as links, payloads, or spoofing artefacts. Modern phishing often avoids those signals and instead imitates the normal cadence, tone, and relationship pattern of a legitimate conversation. Identity baselines help by modelling how a sender usually behaves, who they interact with, and which context is typical for that relationship. That makes it possible to detect a message that is syntactically clean but behaviourally off, which is exactly how many BEC and impersonation campaigns operate.
Practical implication: build detection around behavioural deviation, not just payload inspection.
How OAuth apps and mailbox permissions expand the attack surface
Email compromise is rarely confined to the inbox. Legacy authentication, excessive mailbox permissions, insecure connectors, and overly permissive OAuth apps let an attacker move from message access to broader identity abuse. OAuth is particularly risky when an app gains delegated access that outlives the original message event, because the credential boundary shifts from a single mailbox to connected SaaS workflows. That is why posture management for email must include continuous review of permissions, app consent, and account delegation rather than treating mail security as a standalone layer.
Practical implication: inventory delegated access and risky app grants as part of email security monitoring.
Why human reporting needs automated triage
User-reported phishing is valuable only if the organisation can turn reports into usable signals quickly. Manual abuse-mailbox triage creates inconsistent decisions, slow containment, and weak feedback into detection models. Automation improves the quality of the signal by clustering similar reports, enriching them with context, and feeding verified outcomes back into detection and response workflows. In practice, this turns user behaviour into an operational sensor rather than a backlog queue.
Practical implication: automate report handling so user submissions become detection input, not just tickets.
Threat narrative
Attacker objective: The attacker wants trusted access that can be used to impersonate people, redirect workflows, or trigger fraudulent actions without obvious malicious payloads.
- Entry begins when the attacker abuses trusted relationships or compromised identities rather than relying on a clearly malicious attachment or link.
- Credential or access abuse follows through compromised accounts, risky OAuth permissions, or overbroad mailbox and collaboration privileges.
- Impact occurs when the attacker uses that trusted access for internal fraud, vendor impersonation, or cross-application misuse that appears legitimate to message filters.
Breaches seen in the wild
- EmeraldWhale Git config credential theft: Tokens in exposed .git/config files let EMERALDWHALE clone private repositories and steal more than 15,000 cloud credentials.
- Azure Key Vault Contributor escalation 2024: Datadog found Azure Key Vault Contributor could add itself to access policies and read every secret, key and certificate in a vault.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Email security has become an identity governance problem, not a content-filtering problem. The article shows that attackers increasingly win by abusing trust relationships, account state, and collaboration context rather than malicious payloads. That shifts the control point from message inspection to identity posture, because the dangerous event is often trusted access being used in an untrusted way. Practitioners should treat email as a governed identity surface, not just a detection channel.
Cross-platform identity correlation is the missing control plane. Compromised identities now pivot across email, SaaS, and collaboration tools, which means single-system visibility is structurally incomplete. The important governance question is no longer whether one mailbox looked suspicious, but whether the surrounding identity graph shows anomalous delegation, risky consent, or session drift. IAM and NHI teams should align on a shared risk model for connected identities.
Misconfiguration hygiene is still the easiest breach path. Excessive permissions, legacy authentication, insecure connectors, and risky OAuth apps remain a repeatable failure mode because they extend trust farther than teams intend. This is the kind of exposure that post-breach forensics consistently finds in email-led incidents. The practitioner takeaway is that posture drift in email and collaboration systems must be monitored as continuously as endpoints and cloud workloads.
Human awareness programmes now need machine-backed measurement. Static phishing simulations and generic awareness training do not keep pace with AI-generated social engineering or relationship-aware fraud. The article points toward adaptive, telemetry-driven training because the security problem is behavioural and contextual, not merely educational. That makes human risk intelligence part of identity governance, not a separate awareness silo.
Identity risk modeling is the named concept that best captures the market shift. Email platforms are being pushed to evaluate who is talking to whom, how that relationship normally behaves, and whether account or delegation state has changed. That is a broader security model than spam filtering or rule-based phishing detection, and it aligns with how modern attackers operate. Practitioners should expect email defence to converge with IAM telemetry and governance analytics.
From our research library:
- 73% of vaults are misconfigured, leading to unauthorised access and exposure of sensitive data, according to the Ultimate Guide to NHIs.
- Read next: Identity Security Programme Guide
What this signals
Mailbox and collaboration governance now sit inside the identity programme. Email-led fraud is not just a security-awareness issue, because the real exposure often lives in risky OAuth consent, delegated access, and legacy authentication paths. Teams that already govern account lifecycle and privilege should extend that discipline to inbox-adjacent controls and collaboration platforms.
Misconfiguration hygiene remains a durable fraud reduction lever. The article’s emphasis on excessive permissions and risky app grants means that identity posture is still the cheapest place to reduce attack surface. According to the Ultimate Guide to NHIs, 73% of vaults are misconfigured, leading to unauthorised access and exposure of sensitive data. The same operational pattern shows up here in email and SaaS trust paths.
For practitioners
- Map email controls to identity risk signals Correlate login behaviour, session changes, collaboration activity, and delegated access so email alerts are evaluated in identity context rather than in isolation.
- Review OAuth and mailbox permissions continuously Flag risky OAuth grants, excessive mailbox delegation, legacy authentication, and insecure connectors as part of the same posture review cycle.
- Automate abuse-mailbox triage Use classification, clustering, and enrichment to turn user-reported messages into actionable detections instead of manual queue work.
- Build adaptive phishing simulation from telemetry Tie simulations to observed user behaviour and current attack patterns so awareness content reflects actual exposure rather than generic training modules.
- Monitor vendor trust paths as identity risk Track unusual vendor communication patterns, invoice behaviour, and account compromise indicators because trusted third parties are common fraud pivots.
Key takeaways
- Modern email compromise succeeds by abusing trusted identities, not just by delivering malicious content.
- The main exposure spans collaboration systems, OAuth grants, mailbox permissions, and vendor trust relationships.
- Identity-aware detection and automated triage are the controls most likely to reduce dwell time and improve response quality.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | The article ties email compromise to legacy auth and account misuse. |
| NHI-05 — Overprivileged NHI | Excessive permissions and delegated access are central to the article's risk model. | |
| NHI-10 — Human Use of NHI | Human users abusing trusted access and collaboration systems create the fraud path described here. | |
| Recommendation — Remove legacy authentication paths and enforce stronger account authentication for mail and collaboration access. Review delegated email and SaaS access for overprivilege and shrink standing permissions. Limit human misuse of trusted non-human and delegated access paths through monitoring and policy. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article repeatedly points to permissions, delegation, and risky app grants. |
| Recommendation — Continuously review permissions, entitlements, and authorisations across email-connected systems. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Legacy authentication and account misuse are core issues in the article. |
| Recommendation — Manage authenticators so stale or weak authentication paths are removed from email access. | ||
| MITRE ATT&CK | TA0006; TA0008 — Credential Access; Lateral Movement | Compromised identities are used to move from one trusted system into others. |
| Recommendation — Map trusted-account abuse to credential access and lateral movement detections. | ||
Key terms
- Identity risk analytics: Identity risk analytics is the use of access behaviour, entitlement patterns, and context signals to identify risky identity states. In SoD governance, it helps teams detect conflicting access combinations earlier and connect those findings to remediation workflows before they become audit findings or operational incidents.
- Abuse-mailbox triage: The process of handling user-reported suspicious emails, classifying them, enriching them, and turning them into action. In mature programmes, this becomes an automated detection input rather than a manual backlog, which improves speed and consistency.
- Delegated Access: Delegated access is permission granted to one identity to act on behalf of another user, service, or system. In NHI environments, this usually appears in OAuth-connected apps and automation tooling. It is powerful, but it must be tightly scoped and reviewed because it can persist long after the original business need ends.
- Behavioural Telemetry: Operational evidence that shows what an identity actually did, not just what it was allowed to do. For autonomous systems, behavioural telemetry is essential because policy compliance alone cannot prove that the sequence of actions was safe.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 27, 2026.
Updated on October 8, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org