TL;DR: Email advanced threat protection metrics only become meaningful when population, time window, event definition, data source, and denominator are explicit, because catch rate, detection, remediation, and human-risk measures answer different questions and can hide exposure if collapsed into one score, according to Adaptive Security.
At a glance
What this is: This is a framework for measuring email advanced threat protection across detection, remediation, and human behaviour, with the central finding that single headline percentages obscure exposure.
Why it matters: It matters because IAM, SOC, and security leaders need defensible measures of whether email controls reduce risk, not just whether they generate activity or training completions.
By the numbers:
- Phishing remained the top cyberattack vector for the fourth consecutive year, according to IBM's Cost of a Data Breach Report 2026 cited by Adaptive Security.
- Voice and SMS phishing specifically appeared in 17% of attacks, according to IBM's Cost of a Data Breach Report 2026 cited by Adaptive Security.
Context
Email threat metrics fail when teams treat a single percentage as proof of control performance. The article’s core point is that measurement only works when the population, timing, event definition, and denominator are all explicit, because email security spans delivery, detection, investigation, remediation, and employee response.
That makes this topic relevant to IAM and broader security governance because email compromise often becomes an access problem after the message lands. If phishing, credential submission, or account takeover are measured badly, leaders can misread actual exposure, overestimate control effectiveness, and miss where human behaviour and identity controls intersect.
Key questions
Q: What breaks when email threat metrics do not define the denominator?
A: Without a fixed denominator, email metrics become comparable in appearance but not in meaning. A catch rate, block rate, or exposure rate can all change simply because the sample changed, not because protection improved. Teams should define the population, event type, and time window before they compare results across controls, teams, or quarters.
Q: Why do email security metrics need separate clocks for detection and remediation?
A: Because detection speed and cleanup speed measure different failures. If a team mixes them into one total, it cannot tell whether the delay came from alerting, triage, containment, or removal. Separate clocks make it possible to see where resilience is weak and which stage needs operational attention.
Q: What are the signs that phishing awareness metrics are misleading?
A: Warning signs include low click rates but repeated risky behaviour, no distinction between privileged and low-access users, and training that does not change after new threat patterns emerge. If reporting cannot show which people are most exposed and why, the programme is probably measuring compliance more than security.
Q: How should security teams connect email metrics to IAM outcomes?
A: Link email metrics to identity outcomes whenever credential submission, account takeover, or mailbox compromise is part of the incident path. That means tracking resets, revocations, recovery scope, and exposed accounts alongside message-level measures. Otherwise the organisation can understate the access risk that began as an email event.
Technical breakdown
Why catch rate and detection rate are not the same thing
Catch rate and detection rate look similar but answer different questions. Detection rate measures how many confirmed threats a control identified within the chosen population, while catch rate usually measures how many threats were stopped or removed before meaningful exposure. The distinction matters because post-delivery detection can still leave users exposed, and a high pre-delivery block figure can hide messages that arrived through other paths. Measurement only becomes credible when the threat population, time window, severity, and telemetry boundary are fixed.
Practical implication: Separate pre-delivery blocking from post-delivery detection in dashboards and board reporting.
How MTTD, response time, and dwell time should be measured
Mean time to detect, response time, and dwell time are not interchangeable clocks. MTTD measures how long it takes to recognise a threat, response time measures how long it takes to act after detection, and dwell time measures how long the threat remains reachable in mailboxes or downstream systems. If these are blended into one number, teams cannot tell whether the delay happened in alerting, triage, containment, or cleanup. Good metrics preserve timestamps for delivery, first detection, confirmation, containment, and final removal.
Practical implication: Track each stage separately so remediation bottlenecks are visible.
Why human-risk metrics belong beside technical controls
Email security is not just a control problem, because employees interact with threats after technical filtering has already made a decision. Click rate, credential-submission rate, report rate, and accurate-report rate show whether user behaviour reduced or increased exposure, but only when campaigns are normalised for difficulty and audience. Completion rates alone say little about resilience. The stronger signal is whether the workforce created earlier detection, fewer unsafe interactions, and faster containment over time.
Practical implication: Measure behaviour change with controlled campaign comparisons, not training completion counts.
Threat narrative
Attacker objective: The attacker seeks to turn a single delivered message into measurable account compromise, operational disruption, or fraud while remaining invisible to weak metrics.
- Entry occurs when malicious email reaches a mailbox, whether through pre-delivery bypass, delayed detection, or a path outside the primary gateway.
- Credential theft or account compromise follows when the recipient clicks, submits credentials, or otherwise interacts with the lure.
- Escalation happens when compromised access is used to reach mailboxes, data, or payment workflows with more privilege than the original recipient had.
- Impact is realised when the organisation cannot prove what was exposed, how quickly it was contained, or whether the control actually reduced risk.
Breaches seen in the wild
- Samsung ChatGPT leak 2023: Samsung staff pasted chip source code and meeting notes into ChatGPT weeks after it was allowed, leading Samsung to restrict generative AI tools.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Email security metrics collapse without a defined denominator: the article correctly treats population, time window, event definition, and data source as first-order controls, not reporting footnotes. That is the difference between a defensible exposure measure and a vanity percentage that can be improved by changing the sample. For practitioners, the implication is simple: if the denominator shifts, the control story shifts with it.
The important control question is not whether email is blocked, but where the control boundary stops: pre-delivery filtering, post-delivery detection, employee reporting, and remediation are separate governance stages. When they are merged, security teams can celebrate a gateway metric while users still open and act on malicious content. Practitioners should therefore treat email protection as a lifecycle with different control owners at each stage.
Human-risk measurement is an identity problem as much as a security problem: phishing click rate and credential-submission rate describe how people behave when trust is abused, which is where IAM consequences begin. Once a user gives up credentials, the incident stops being only an email event and becomes an access-governance event. The practical conclusion is that email metrics must be linked to identity outcomes such as compromised accounts, reset actions, and recovery scope.
Separate clocks expose where resilience actually fails: MTTD, mean time to respond, and MTTR are distinct operational signals, and collapsing them hides whether the delay sits in detection, triage, containment, or cleanup. That creates governance debt because leadership thinks the programme is faster than it is. For security leaders, the real task is to make every stage measurable enough to assign accountability and improve it.
What this signals
Metric discipline is the real control here: email security programmes that cannot separate delivered threats, detected threats, and remediated threats will keep producing confident but incomplete reporting. Practitioners should expect boards to ask for exposure, not just block counts, because exposure is what connects mail security to business risk.
Identity teams should treat phishing as an access-control precursor: once a user submits credentials, the incident moves from email hygiene into account governance, privilege reset, and session containment. That is why reporting rates and credential-submission rates belong in the same operational conversation as recovery time and compromised-account handling.
For practitioners
- Define a measurement ledger for every email metric Specify population, time window, event definition, data source, and denominator before any metric is published or compared.
- Split block, detect, and remediation reporting Report pre-delivery blocking, post-delivery detection, and downstream remediation as separate measures so one control result cannot mask another.
- Track response clocks separately Preserve timestamps for delivery, first detection, analyst confirmation, containment, and final removal so MTTD, response time, and dwell time remain distinct.
- Measure employee behaviour with controlled campaigns Compare cohorts with similar roles and campaign difficulty, then use click rate, reporting rate, and credential-submission rate to assess behaviour change.
Key takeaways
- Email threat measurement only becomes reliable when teams define the population, denominator, and event boundaries before they compare results.
- A single catch-rate number can hide delivered messages, user interaction, analyst workload, and remediation lag.
- The most useful programme changes are the ones that reduce exposure, speed containment, and tie message metrics to identity outcomes.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | DE.CM-01 — Anomalies and Events | The article centres on measuring detection outcomes and event handling in email security. |
| RS.MA-01 — Incident Management | Remediation, containment, and response timing are core to the metric framework discussed. | |
| PR.DS-10 — Integrity Checking | The article discusses preserving evidence and validating message state across the lifecycle. | |
| Recommendation — Measure email telemetry against DE.CM-01 so detection metrics reflect real events, not just vendor summaries. Track response and remediation metrics under RS.MA-01 to show how quickly email threats are contained. Use PR.DS-10 to ensure message handling preserves integrity from delivery through removal. | ||
| CIS Controls v8 | CIS-17 — Incident Response Management | The framework is about response, investigation, and recovery metrics after malicious email exposure. |
| Recommendation — Tie email response metrics to CIS-17 so triage, containment, and recovery remain measurable. | ||
| MITRE ATT&CK | TA0001;TA0006;TA0009 — Initial Access; Credential Access; Collection | The article maps email attacks to delivery, credential theft, and post-click impact. |
| Recommendation — Map email threat telemetry to TA0001, TA0006, and TA0009 to align metrics with attacker progression. | ||
Key terms
- Email Threat Detection: Email threat detection is the process of identifying malicious, suspicious, or high-risk messages before users interact with them. It often combines signatures, rules, and machine learning, and effective programmes measure not only block rates but also accuracy, analyst load, and response quality.
- Catch Rate: The percentage of threats a provider says it stopped or removed within the measured set. In practice, this figure can be misleading unless the testing population, severity mix, and evaluation method are disclosed, because a high catch rate may still leave delivered messages and user exposure unresolved.
- Dwell Time: Dwell time is the period between an attacker gaining access and defenders detecting or removing them. Shortening dwell time matters because most damage happens while the attacker remains unnoticed. In identity-led environments, reducing dwell time depends on visibility into access paths, privileges, and session behaviour.
- Credential-Submission Rate: The percentage of delivered recipients who enter credentials into a simulated or malicious form after interacting with an email lure. It is a stronger behavioural signal than click rate because it captures movement from curiosity to unsafe disclosure, which is the point where identity risk begins.
Deepen your knowledge
The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity, and machine identity security for practitioners who need to connect access risk to operational controls. It is designed for teams that must govern identities, credentials, and lifecycle controls across modern security programmes.
Published by the NHIMG editorial team on October 16, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org