Email identity is becoming a shared attack surface for humans and agents

At a glance

What this is: This analysis argues that email remains the dominant digital identifier, but agentic AI now expands that identity surface into systems that read, interpret, and send email.

Why it matters: IAM, PAM, and ITDR teams need to treat email-linked identity as a human and non-human governance problem because compromise now affects both users and the agents they delegate to.

By the numbers:

• Between 64.9% and 92.4% of web applications use email addresses as the primary identifier for critical functions.
• Proofpoint has found that 59% of compromised accounts had MFA enabled.
• According to the Verizon 2025 Data Breach Investigations Report, 54% of ransomware victims had credentials stolen prior to the ransomware attack.

👉 Read Proofpoint's analysis of email identity, credential theft, and agentic AI risk

Context

Email identity is the operational anchor for most digital services, which is why compromise of an inbox often becomes compromise of the account, the recovery path, and the trust chain around it. In human IAM terms, that makes email a high-value identifier rather than just a communications channel.

Agentic AI changes the problem because systems now read, interpret, and send email on behalf of people and processes. That shifts email from a human access surface to a mixed identity surface where human, NHI, and agent behaviour intersect, and where existing IAM assumptions about who is acting are less reliable.

Key questions

Q: How should security teams reduce identity risk in email-driven workflows?

A: Security teams should remove email as the trusted authority for sensitive identity actions wherever possible. Password resets, approvals, recovery steps, and exception handling should move to stronger verification methods and auditable workflow controls. The goal is to prevent a compromised inbox from becoming a path into broader account control.

Q: Why do compromised identities matter so much in email security?

A: Because a trusted account can move from email into collaboration tools, SaaS apps, and financial workflows without triggering the same suspicion as an external attacker. Once the identity is compromised, the attacker can impersonate internal trust, making identity correlation more valuable than message-only inspection.

Q: What do organisations get wrong about MFA and email compromise?

A: They assume MFA means the account is safe. In practice, attackers still use token theft, prompt fatigue, phishing, and recovery abuse to take over the identity after MFA is present. The control reduces risk, but it does not remove the need for detection, containment, and recovery-path hardening.

Q: How do AI agents change email governance for IAM teams?

A: AI agents that read or send email become non-human identities with delegated authority. That means their mailbox access, content handling, and outbound actions need lifecycle control, scope limits, and monitoring. If the agent can trigger business actions, it needs governance that matches the impact of those actions.

Technical breakdown

Why email became the default identity layer

Email persists as the default digital identifier because it is globally unique, easy to verify, and widely used for account creation and password recovery. That convenience creates architectural dependence: the identifier, the recovery channel, and often the authentication flow all collapse into the same mailbox. When an attacker gains control of that mailbox, they can frequently reset credentials, intercept approvals, and impersonate the user across services. The real issue is not email itself, but the concentration of identity trust in one routable address.

Practical implication: separate identity recovery from inbox control wherever possible and reduce how many services treat email as the sole trust anchor.

How compromised email turns into identity takeover

Credential theft remains the most efficient entry path because email access often exposes both direct login and secondary recovery options. Attackers use phishing, malware, token theft, and MFA fatigue to get past controls, then leverage the mailbox to reset passwords or approve transactions. IAM and PAM can constrain what a compromised identity can reach, but they do not stop the compromise itself. ITDR matters here because it can detect anomalous use and force re-authentication, but only after the account has already been abused.

Practical implication: pair identity detection with mailbox compromise response playbooks and review where email access still enables silent account recovery.

What agentic AI changes in email security

Agentic AI systems do more than automate tasks. They can interpret content, generate responses, and in some deployments act directly on emails or attachments, which makes them identity-relevant actors rather than passive tools. That creates a new class of exposure: prompt injection inside messages, malicious content that steers agent behaviour, and data leakage through agent memory or delegated actions. If an agent can take email-driven action, then email security becomes part of AI identity governance, not just human phishing defence.

Practical implication: inventory which AI systems touch mailboxes, what actions they can take, and where human approval remains mandatory.

NHI Mgmt Group analysis

Email is no longer just a human identifier, it is a shared identity control plane. The article shows that email links creation, authentication, recovery, and notification across platforms, which means compromise cascades faster than most IAM programmes model. The practitioner conclusion is that email must be governed as an identity dependency, not treated as a mere contact field.

Compromised credentials remain the shortest route from inbox exposure to business impact. Proofpoint cites 59% of compromised accounts with MFA enabled and Verizon reports credentials stolen before 54% of ransomware incidents, which shows that layered authentication does not eliminate identity abuse. The practitioner conclusion is that detection and containment must be designed around assumed compromise, not around the idea that MFA closes the case.

Agentic AI turns inbox governance into NHI governance. Once an AI system can read, interpret, and send email, it becomes an identity-bearing actor that can be phished, manipulated, or over-scoped in ways human-centric controls do not anticipate. The practitioner conclusion is that email policy, agent permissions, and data-loss controls now need to be aligned across human and non-human actors.

Ephemeral trust in email-driven workflows creates hidden privilege expansion. The same mailbox that handles routine communication can also authorize password resets, payment actions, and delegated agent tasks, which creates an identity blast radius that is larger than the access grant itself. The practitioner conclusion is that teams should measure not just who can open email, but what email can unlock downstream.

Intent-based protection is only useful if the identity model underneath it is accurate. Filtering malicious content is necessary, but the deeper issue is whether the organisation knows which identities, human or machine, are acting on email content and what authority they hold. The practitioner conclusion is that identity governance must precede content-centric defence.

From our research:

• 98% of companies plan to deploy even more AI agents within the next 12 months, despite documented rogue behaviour in 80% of current deployments, according to AI Agents: The New Attack Surface report.
• Only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
• For the broader breach pattern, see Moltbook AI agent keys breach for how exposed agent credentials scale into operational risk.

What this signals

Email identity now needs to be governed like a delegated access surface. If a mailbox can initiate resets, authorise workflows, and feed AI systems, then the programme needs control points around recovery, approval, and downstream privilege. The practical shift is to classify email-linked flows by blast radius rather than by convenience.

With 52% of companies still unable to track and audit the data their AI agents access, per AI Agents: The New Attack Surface report, agentic email use creates an auditability gap that extends beyond phishing. Teams should expect mailbox-connected agents to become part of access review, data governance, and incident response.

Inbox-to-action chains are the new governance boundary. When an email can trigger an account reset, a payment, or an AI action, the control problem shifts from message security to identity authorisation. That boundary should be explicit in policy, logging, and privileged workflow design.

For practitioners

• Map email to downstream identity dependency Inventory every system that uses email for account creation, recovery, notification, or approval. Prioritise the services where mailbox access can reset credentials or authorise high-risk actions.
• Separate inbox access from recovery authority Remove email as the only recovery path for privileged or sensitive accounts and require stronger verification for resets, step-up access, and delegated approvals.
• Treat mailbox compromise as an identity incident Update ITDR and incident playbooks so a compromised mailbox triggers session review, token revocation, and access-path analysis across connected services.
• Inventory AI systems that can read or send email Document which agents, copilots, or workflow systems have mailbox access, what prompts or messages they process, and whether they can act without human approval.

Key takeaways

• Email remains the dominant digital identifier, which means inbox compromise often becomes identity compromise across multiple systems.
• The data show that MFA and other layered controls reduce risk but do not eliminate credential abuse, especially when recovery paths remain weak.
• Agentic AI extends email from a human communication channel into a non-human identity surface that must be governed as part of IAM and ITDR.

Key terms

• Email identity: The use of an email address as the practical identifier that ties a user or system to accounts, recovery, and notifications. In modern environments, email identity often becomes the trust anchor for authentication flows, which makes inbox compromise an identity problem rather than a messaging problem.
• Credential Compromise: Credential compromise occurs when an attacker obtains or successfully abuses a password, token, certificate, session, or other authentication artifact. In practice, the compromise may be theft, replay, phishing, or recovery-path abuse, and it often becomes dangerous only after the identity is used to perform trusted actions.
• Agentic Workspace: An agentic workspace is an environment where humans, AI agents, and connected tools operate in shared workflows. The security challenge is that actions may be distributed across multiple identities and systems, making scope, traceability, and accountability harder to maintain.

What's in the full article

Proofpoint's full article covers the operational detail this post intentionally leaves for the source:

• Specific examples of email-based credential theft, MFA bombing, and prompt injection patterns observed in the field
• The vendor's framing of agentic workspace protection and how it maps to mailbox monitoring and exfiltration controls
• Additional explanation of how AI tools assigned to email workflows can be targeted through hidden prompts and malicious content
• The original examples and narrative around human-centric security expanding into agent-centric security

👉 Proofpoint's full article covers the email attack evolution, agent behaviour, and the security shift from inbox protection to agent-centric defence.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.