TL;DR: A construction services firm found that layering Barracuda with Abnormal still left phishing, spam, and account takeover attempts reaching inboxes and downstream SaaS apps, according to Proofpoint. The case shows that post-delivery detection alone does not close identity abuse and collaboration risk gaps.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Proofpoint's blog post: A layered email stack still failed to stop phishing, spam and account takeover attempts from reaching users and downstream SaaS applications.
Why it matters: This matters because email controls that stop at inbox delivery leave identity compromise and SaaS abuse exposed, which is a direct concern for IAM, PAM and NHI governance teams.
Context
Email security often fails when teams treat delivery filtering, inbox analysis and account compromise as separate problems. In practice, phishing now uses email as an entry point into identity, collaboration and SaaS access, so controls that only inspect messages after delivery miss the moment when an account or session is first at risk.
This article sits at the boundary of email security and identity governance. The firm's experience shows why account takeover has become an access-control problem as much as a messaging problem, because compromised credentials can pivot into SaaS applications and create downstream control failures that are hard to unwind.
Key questions
A: Threats are more likely to reach users before defenders can intervene, especially social engineering and links that look legitimate at first glance. That increases the chance of credential theft, fraudulent payments, and lateral phishing. Post-delivery controls still matter, but they work best as a second layer after early filtering, sandboxing, and intent analysis.
Q: Why does account takeover make phishing harder to stop?
A: Account takeover is dangerous because the attacker sends from a valid, trusted identity. That bypasses many inbox controls and makes internal recipients more likely to comply. The risk is no longer only the initial phishing message, but the attacker’s ability to use the compromised account for lateral phishing, forwarding and data theft.
Q: What signs show that email identity controls are not keeping pace?
A: Watch for stale shared mailboxes, persistent delegated send permissions, accounts that remain active after role change, and alerts that show unusual sending behaviour from trusted identities. Those signals usually mean the organisation is protecting the inbox but not the identity behind it.
Q: How should teams respond when compromised email accounts can reach SaaS applications?
A: Teams should isolate the account, revoke active sessions and tokens, and review which SaaS applications inherit access from that identity before the attacker can move laterally. The goal is to stop the compromised account from acting as a bridge into collaboration and business systems. Containment has to happen at the identity layer, not only in the mail flow.
Technical breakdown
Pre-delivery versus post-delivery email protection
Pre-delivery controls inspect and stop messages before they reach the user, while post-delivery controls look for suspicious content after it lands in the inbox. The article shows why that distinction matters: if detection happens after delivery, the user has already been exposed and the message may already have triggered credential theft, business email compromise or malicious forwarding. In collaboration-heavy environments, the delay between delivery and detection creates a larger attack window than many teams assume. Identity security then becomes part of message security because the first failure is not just spam receipt, but account abuse that follows it.
Practical implication: move high-confidence phishing prevention upstream of inbox delivery and treat post-delivery review as a secondary control, not the primary defence.
Why account takeover breaks the email security stack
Account takeover changes the threat model because the attacker is no longer trying to send a malicious message, but to operate as a legitimate user inside email and SaaS systems. That makes traditional perimeter thinking ineffective. Once credentials are compromised, attackers can use the real account to reply in-thread, access shared files, trigger workflow approvals or move into connected applications. The article's emphasis on downstream SaaS access shows that email controls alone cannot contain a compromised identity once authentication has already succeeded. The core issue is identity trust, not message filtering.
Practical implication: bind email security, identity telemetry and SaaS session controls together so compromise signals can trigger containment before the account spreads into other services.
Collaboration security needs one control plane for identity and supplier risk
The article points to a broader architectural problem: teams that switch between multiple consoles lose speed, context and consistency when investigating phishing, account compromise and supplier exposure. A fragmented workflow makes it harder to connect one malicious message to a user identity, a SaaS session and a third-party risk event. That is why collaboration security increasingly needs integrated visibility across email, SaaS and supplier relationships. The important shift is not vendor consolidation for its own sake, but governance consolidation around the identity paths that attackers actually exploit.
Practical implication: design collaboration security around the user, the session and the third-party connection, rather than around isolated product categories.
Threat narrative
Attacker objective: The attacker objective is to turn a trusted user account into a foothold for SaaS access, fraud and broader collaboration compromise.
- Entry occurs through phishing and spam that reach the inbox despite layered email controls, giving attackers a path to interact with users.
- Credential theft or account compromise follows when users engage with the message or when attackers reuse stolen access against the account.
- Escalation happens when the compromised identity is used to reach downstream SaaS applications and collaboration tools.
- Impact is account takeover across email and connected SaaS services, with fraud and remediation overhead spreading beyond the original inbox event.
Breaches seen in the wild
- Gitloker GitHub extortion campaign: Phishing via GitHub notifications tricked developers into authorising malicious OAuth apps; Gitloker then wiped repos and demanded contact.
- CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Account takeover has become an identity governance problem disguised as an email problem. The article shows that message-layer controls can still leave the actual trust boundary untouched when the user identity itself is compromised. Once a legitimate account is abused, downstream SaaS access, shared workspaces and approvals all inherit the risk. Practitioners should treat account takeover as a cross-domain identity event, not just a mail hygiene failure.
Layering tools without a unified trust model creates control fatigue. The firm's experience shows that adding API analysis on top of a gateway can increase operational complexity without reducing exposure if detection still happens too late. This is the security equivalent of compensating controls that do not share context, which leaves gaps between alerting, containment and access revocation. Practitioners should align email, identity and SaaS policies around the same compromise signal.
Collaboraboration security now depends on who can act, not only what can be delivered. The article's strongest signal is that modern phishing works because it seeks account control, not merely message delivery. That means security programmes must govern identity states across email and connected SaaS, including when an account is valid, when it is suspected, and when it must be isolated. Practitioners should evaluate their control stack on whether it can interrupt misuse after authentication, not just before delivery.
Supplier risk belongs in the same operating picture as account takeover. The article notes that visibility into third-party compromise was part of the firm's decision criteria, which reflects a wider governance truth: supplier access expands the blast radius of any compromised identity. That creates a named concept worth watching, collaboration trust sprawl, where email, SaaS and supplier pathways overlap faster than teams can govern them. Practitioners should reduce that sprawl with shared visibility and access boundaries.
What this signals
Collaboration trust sprawl: when email, SaaS and supplier pathways are governed separately, the attacker only needs one trusted account to cross several control boundaries. The practical test for security teams is whether one compromise signal can isolate the identity everywhere it operates, not just in the mailbox.
For identity and security programmes, the next maturity step is to stop measuring email protection by message volume alone. The better measure is whether a suspicious message can be tied to account state, session activity and downstream application access before the compromise spreads.
For practitioners
- Strengthen pre-delivery phishing controls Prioritise controls that block malicious messages before they reach users, especially for high-value mailboxes and distributed project teams. Use inbox filtering as a backstop, not the first line of defence.
- Tie account takeover alerts to identity containment When compromise is suspected, trigger session isolation, password reset, token revocation and SaaS access review together so the account cannot continue operating across collaboration tools.
- Review downstream SaaS exposure paths Map which collaboration and business applications can be reached from a compromised email identity, then identify where an attacker could pivot after a successful login or token reuse.
- Consolidate investigation around one collaboration risk workflow Reduce console switching by linking email events, identity signals and supplier compromise alerts into a single triage path that supports faster containment decisions.
Key takeaways
- The article shows that layering email tools can still leave phishing and account takeover paths open when controls only react after delivery.
- The key failure is not lack of alerts, but lack of control over the identity and sessions that follow a successful message-based attack.
- Teams need containment that links inbox events to identity revocation and SaaS access restriction before compromised accounts can spread.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | TA0006; TA0008 — Credential Access; Lateral Movement | The article centres on phishing leading to account takeover and movement into SaaS tools. |
| Recommendation — Map inbox compromise to TA0006 and downstream SaaS pivoting to TA0008 so containment aligns to the attack path. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The core failure is that compromised identities retained effective access across collaboration apps. |
| Recommendation — Review entitlement paths under PR.AA-05 so email compromise cannot carry valid access into SaaS. | ||
| CIS Controls v8 | CIS-5 — Account Management | The article highlights the need to contain compromised user accounts quickly across connected systems. |
| Recommendation — Use CIS-5 to tighten account lifecycle and disable compromised identities before they spread laterally. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Credential misuse and account takeover are central to the attack pattern described in the article. |
| Recommendation — Apply IA-5 to govern authenticator revocation and limit reuse after suspected compromise. | ||
Key terms
- Account Takeover: Account takeover is unauthorized use of a legitimate account after an attacker obtains valid access through stolen credentials, tokens, or trusted integrations. The key security problem is that the resulting activity often looks normal to logs and controls, which makes containment and attribution harder than in a forced-entry breach.
- Post-delivery Protection: Post-delivery protection is the ability to detect, investigate and remove a malicious email after it has already reached the inbox. In cloud email environments, this usually depends on mailbox API access, retrospective analysis and automated clawback across affected users.
- Post-delivery detection: Post-delivery detection is the ability to identify malicious or risky email activity after a message has reached a mailbox. It matters because many modern attacks are not obvious at delivery time, so defenders need telemetry from user interaction, mailbox rules, and account behaviour to spot abuse before business impact occurs.
- Collaboration Security: Collaboration security covers the controls that protect email, shared workspaces, messaging, and connected SaaS applications. It is broader than spam filtering because it has to account for identity compromise, impersonation, external trust, and downstream workflow abuse.
Deepen your knowledge
NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security and secrets management. It helps practitioners connect identity controls to the wider security programme that has to govern access, trust and remediation.
Published by the NHIMG editorial team on July 14, 2026.
Updated on October 13, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org