Email security incidents persist despite SEGs, driving ICES adoption

At a glance

What this is: Knowbe4 argues that secure email gateways alone are not preventing email security incidents, with most organisations still experiencing incidents and many leaders considering replacement.

Why it matters: This matters because email is now governed by a mix of identity, content, and user-behaviour controls, so IAM and security teams need to reassess where enforcement actually occurs.

By the numbers:

• 94% of organisations still experience email security incidents despite investment in secure email gateways.
• 87% of cybersecurity leaders are now looking to replace their secure email gateways.
• Advanced phishing attacks are bypassing SEG detection more often, with a 47% increase in attacks getting through detection.

Context

Email security has shifted from a single gateway problem to a broader control-plane problem. SEGs still matter for filtering, but they do not fully address identity-driven phishing, outbound data loss, or user-error scenarios that occur after the message crosses the gateway boundary.

That gap matters to IAM because email remains a primary identity attack surface. Phishing, impersonation, and misdirected messages exploit trust decisions, while static DLP struggles when the control must interpret context rather than simply match rules. The article’s core point is that the old perimeter model is now too narrow for the way email abuse actually happens.

Key questions

Q: Why do secure email gateways miss phishing campaigns that use legitimate third-party services?

A: Secure email gateways miss these campaigns because they are built around static rules, keyword checks, and allowlists. That model works poorly when attackers send from a trusted service instead of an obviously malicious domain. Without behavioral analysis, the gateway cannot judge whether the message content, sender relationship, or request is inconsistent with normal organizational activity.

Q: When should organisations replace static DLP in email security?

A: Replace static DLP when your main outbound risks are misdirected emails, human error, and context-heavy disclosure that rules cannot interpret reliably. If sensitive content can leave through the wrong recipient or a legitimate-looking workflow, the control needs recipient validation, classification context, and behavioural enforcement rather than keyword-centric blocking.

Q: What breaks when secure email gateways are the main email security control?

A: When SEGs are treated as the main control, organisations often miss identity-based phishing, internal impersonation, and outbound leakage driven by human error. The gateway may still block commodity spam, but it cannot fully govern user action, recipient context, or account compromise. That leaves a gap between message delivery and actual risk reduction.

Q: What should security teams do when SEG coverage and incident rates diverge?

A: Treat the divergence as evidence that the control model is too narrow. Review which incidents bypassed the SEG, which were caused by user action, and which required downstream containment. Then align email controls to identity signals, outbound context, and response ownership so protection reflects how the threat actually works.

Technical breakdown

Why secure email gateways miss identity-driven attacks

A secure email gateway inspects messages at the boundary, but many attacks succeed after delivery because they rely on trust, not just payload content. Modern phishing often uses lookalike identities, thread hijacking, or low-and-slow social engineering that evades simple pattern matching. Once a user trusts the message, the attacker no longer needs to defeat the gateway. That is why email security increasingly depends on identity-aware controls, message context, and downstream detection in the collaboration layer, not only on perimeter filtering.

Practical implication: treat SEG coverage as one layer and add identity-aware detection where messages are acted on, not only where they are received.

Why static DLP breaks on outbound email risk

Static, rules-based DLP works best when the content and destination can be predicted, but email leakage often happens through context loss, human error, or subtle policy violations. A user can send sensitive data to the wrong recipient, forward information into an unmanaged mailbox, or disclose material that does not match a keyword rule. In practice, outbound protection needs context from identity, recipient, sensitivity labels, and workflow state. Without that, DLP becomes a reactive filter rather than a governance control.

Practical implication: enrich outbound controls with recipient verification, policy context, and human error safeguards rather than relying on pattern matches alone.

What integrated cloud email security changes in the control model

Integrated Cloud Email Security combines multiple controls around the email workload, typically pairing native platform controls with cloud-delivered inspection, identity signals, and response workflows. The architectural shift is important because it moves from a single checkpoint to coordinated enforcement across ingress, egress, and user interaction. That is especially relevant where email supports account compromise, token theft, or fraud. The core issue is not just mail security tooling, but whether the organisation can govern the full lifecycle of email threats across identity, content, and response.

Practical implication: evaluate email security as a control system spanning identity, content, and response, not as a standalone gateway purchase.

Threat narrative

Attacker objective: The attacker aims to exploit email trust to steal credentials, move data out of the organisation, or trigger fraud without being blocked at the gateway.

1. Entry occurs through advanced phishing that bypasses SEG detection and reaches the user inbox.
2. Credential harvesting or trust abuse follows when the recipient engages with a convincing message or malicious flow.
3. Impact occurs through account compromise, data exfiltration, or misdirected disclosure that the gateway alone did not stop.

Breaches seen in the wild

• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Email security has become an identity governance problem, not just a mail filtering problem. The article shows that the control boundary has shifted beyond the inbox perimeter. Once attackers rely on impersonation, trust abuse, and social engineering, the deciding control is whether identity signals and user context are available at the point of action. Practitioners should therefore judge email security by how well it governs trust decisions, not only by how many messages a gateway blocks.

Static controls create a false sense of determinism in email defence. Rules-based DLP and legacy SEG policies assume the risky event is visible in advance and can be matched against a fixed rule. Email abuse rarely behaves that neatly. The named concept here is email trust gap, the distance between message delivery and the moment a user decides to act on it. Practitioners should close that gap with identity-aware enforcement and behavioural detection.

Integrated email security is less about consolidation than about correlation. The real value is not a broader tool count, but coordinated decisioning across inbound filtering, outbound data protection, and response. That aligns with a governance model where email is treated as a cross-control workflow involving IAM, data security, and SOC operations. Practitioners should assess whether their stack can correlate the sender, recipient, message content, and downstream user action.

Human error remains a first-class security condition in outbound email risk. The article is explicit that misdirected emails and data exfiltration do not require sophisticated exploitation. That makes email security one of the clearest examples of where human identity governance and content governance intersect. Practitioners should treat mis-send prevention, recipient verification, and sensitivity enforcement as governance controls, not convenience features.

SEGs are now one component in a broader email security architecture, not the architecture itself. The article’s 87% replacement interest signals a category shift in how organisations think about the control stack. That does not mean every SEG is obsolete, but it does mean teams should re-evaluate dependency on a single enforcement point. Practitioners should plan for layered email governance that spans identity, content, and response.

From our research library:

• Organisations that rely heavily on static credentials reported a 20-percentage-point increase in security incidents compared with those with low reliance, according to the 2026 Infrastructure Identity Survey.

What this signals

Email trust gap: the control failure is no longer just whether a malicious message arrives, but whether the organisation can govern the decision that follows delivery. That shifts emphasis toward identity-aware inspection, user-risk context, and response integration across the email stack.

Security leaders should expect email protection to be evaluated less as a gateway purchase and more as a workflow control problem. The organisations that reduce incident volume will be the ones that connect message filtering, outbound governance, and identity signals into one operating model, according to the 2026 Infrastructure Identity Survey

The practical test is whether your stack can stop both sophisticated inbound phishing and ordinary outbound mistakes without relying on static rules alone. If it cannot, the email control plane is lagging the threat surface.

For practitioners

• Reassess SEG dependency against actual incident outcomes Compare the incidents your SEG missed against the attack types the gateway was designed to stop. Focus on phishing that bypassed detection, misdirected mail, and outbound disclosure events that were never visible at the perimeter.
• Add identity-aware controls to email workflows Use sender authentication, recipient validation, and user-risk signals to make email decisions based on identity context rather than only message content. This is especially important where phishing and impersonation drive compromise.
• Replace static DLP rules with contextual outbound controls Tune outbound protection for recipient sensitivity, message context, and workflow state so that human error and data loss are evaluated in context. Static keyword matching is not enough for modern email leakage.
• Correlate platform controls with response playbooks Ensure native Microsoft 365 controls, cloud email inspection, and SOC response workflows are wired together so malicious messages can be contained, removed, or investigated after delivery.

Key takeaways

• Email security incidents persist because SEGs do not govern the full trust decision that happens after delivery.
• The gap is visible in bypassed phishing and outbound errors, where static rules cannot keep pace with context-driven abuse.
• Practitioners should reframe email security as a layered identity, content, and response problem rather than a gateway-only issue.

Key terms

• Secure Email Gateway: A secure email gateway is a control layer that inspects email before it reaches users and can also inspect outbound mail. It filters malicious content, enforces policy, and reduces exposure to phishing, malware, and data leakage, but it does not replace identity governance or account monitoring.
• Integrated Cloud Email Security: Integrated cloud email security combines native cloud email telemetry, policy enforcement, and advanced threat detection into a broader control model. It is designed to cover phishing, impersonation, and outbound risk across the email lifecycle rather than relying on a single perimeter filter.
• Data Loss Prevention: Data loss prevention is the set of controls used to detect, block, and report sensitive data moving in ways the organisation does not allow. In practice, DLP must account for endpoints, email, cloud apps, APIs, and user behaviour, or it will miss the paths where real exposure happens.
• Identity-aware detection: Identity-aware detection is security monitoring that evaluates alerts using identity context such as target role, privilege level, authentication state, and account type. It improves triage because the same suspicious action has different meaning depending on whether it involves a human user, service account, or machine credential.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity, and secrets management. It helps practitioners connect identity controls to the wider security programme that email and collaboration risks now depend on.