Independent testing shows layered email security can catch residual malware

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Coro's announcement: Virus Bulletin certified Coro Email Security in its first VB ESA - M365 test after it achieved zero false positives and blocked all residual malware that Microsoft 365 let through.

Why it matters: For IAM, security, and SOC teams, the finding matters because email filtering has to work alongside Microsoft 365 without creating user disruption or extra quarantine workload.

By the numbers:

• Virus Bulletin ran a continuous stream of live email through a Microsoft 365 tenant over 17 days.
• Coro Email Security recorded zero false positives across the 371 legitimate messages that reached it.
• Coro Email Security caught 99 of the 108 spam messages that made it past Microsoft 365's native filtering.

Context

Email security for Microsoft 365 is increasingly about residual risk, not raw filtering volume. Native controls stop a large share of unwanted mail, but organisations still need a second layer that handles what slips through without disrupting business communications. That makes false positives and incremental detection the real operational measures, especially in lean teams that cannot afford a large quarantine-review workload.

Microsoft 365 security hardening helps explain why organisations often layer third-party email security on top of Exchange Online Protection rather than rely on native filtering alone. The practical question is not whether the base platform blocks mail, but how much additional risk remains after the first layer has already made its decision.

Key questions

Q: How should security teams evaluate email protection when Microsoft 365 is part of the stack?

A: They should test whether all inbound mail is routed through the same inspection path, then compare the same threat set across products and time periods. If Microsoft sits behind an upstream gateway, mailbox-native numbers alone will understate the amount of malicious traffic already stopped before delivery.

Q: Why do false negatives matter more than false positives in email security operations?

A: False negatives matter because they let malicious messages reach users and create real compromise risk, including credential theft and account takeover. False positives still hurt, but their main cost is operational noise and reduced trust in tools. A strong email security program balances both outcomes, because chasing every alert without missing true threats is what keeps defenses usable and effective.

Q: What breaks when an email security layer is tuned too aggressively?

A: Business communications break first. Aggressive filtering can quarantine legitimate invoices, customer updates, and internal approvals, which forces staff to choose between security exceptions and workflow delays. The result is usually lower trust in the control and more pressure to bypass it.

Q: Should organisations rely on Microsoft 365 native filtering alone?

A: Not if they face phishing or malware risk that survives the base layer. Native filtering is essential, but organisations should assess whether a second control materially reduces inbox exposure while keeping legitimate mail flowing. The right decision depends on residual threat volume and the team’s tolerance for operational overhead.

Technical breakdown

Why incremental detection matters in layered email security

Incremental detection rate measures what an add-on email security layer catches after Microsoft 365 has already allowed a message through. That is a different problem from general spam blocking, because the control is only judged against the residual set that reached the inbox path. In practice, that means vendors and buyers should focus on the attack surface left behind by native filtering, not on aggregate block counts. The model is especially relevant when the native stack is Exchange Online Protection alone, because it isolates the value of the extra layer rather than mixing it with a richer bundled defence model.

Practical implication: Measure email security products on residual threats, not on total mail processed.

Why false positives are an operational control, not just a tuning metric

A false positive in email security is not only a detection miss. It is a workflow problem that creates quarantine review, support tickets, delayed invoices, and lost trust in the control itself. For smaller IT teams, even a low false-positive rate can be expensive if it creates a second queue to manage. The important point is that protection and usability are inseparable in email operations. A product that blocks aggressively but interrupts legitimate mail may reduce one risk while increasing another, which is why independent testing puts equal weight on legitimate mail handling. See the Alert Triage Guide.

Practical implication: Set acceptable false-positive thresholds before deployment and validate them with live business traffic.

How API-connected email security differs from mail-routing controls

When an email security product connects through API rather than changing mail routing, it can inspect and remediate messages without altering the transport path. That reduces operational friction, but it also changes what must be governed: permissions, mailbox access, and how remediation actions are scoped. For Microsoft 365 environments, this is an identity and access question as much as a security one, because the protection layer depends on delegated access into the tenant. The governance challenge is to ensure that the control remains narrow, auditable, and aligned to the mailbox and message actions it actually needs. See the Microsoft 365 Security Guide.

Practical implication: Review delegated permissions and mailbox scopes before adopting API-based email security.

Threat narrative

Attacker objective: The attacker aims to deliver malware or phishing content into the inbox after native Microsoft 365 filtering has already failed to stop it.

1. Entry occurs when live spam, phishing, and malware messages reach Microsoft 365 and pass native filtering.
2. Credential or policy weak points are exposed when those residual messages are still able to land in user inbox paths despite the first control layer.
3. Escalation happens when malware or phishing content reaches end users and creates a path to account compromise, payload delivery, or business email abuse.
4. Impact is the delivery of malicious messages that evade native controls unless a second layer catches them before user interaction.

Breaches seen in the wild

• Mimecast certificate compromise 2021: SolarWinds attackers stole a Mimecast certificate that authenticated to Microsoft 365 Exchange and used it against a few customer tenants.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Residual-risk testing is the right yardstick for email security in Microsoft 365. The meaningful question is not how many messages a product blocks in isolation, but what it adds after native filtering has already done its work. That shifts evaluation from headline detection claims to the much harder operational question of whether the layered stack changes inbox exposure in practice. Practitioners should treat incremental detection as the metric that matches real deployment conditions.

Zero false positives is a governance requirement, not a convenience feature. In daily operations, every legitimate message that gets blocked becomes a support case, a delayed transaction, or an exception process. That means email security has to be judged on business continuity as well as threat prevention, especially in lean environments where quarantine queues are expensive to manage. The practical standard is security that reduces work, not security that simply moves work elsewhere.

Microsoft 365 does not eliminate the need for an external email control plane. Native filtering is foundational, but it does not guarantee that residual threats will not reach users. The practical implication for identity and access programmes is that mail security, tenant permissions, and remediation scope have to be governed together, not treated as separate procurement decisions. Add-on controls must be narrow enough to fit the tenant model they operate in, including Microsoft 365 security hardening where the broader platform baseline is concerned.

Incremental protection changes how buyers should define success for layered email defence. Teams should ask whether a control closes the gap left by native filtering, whether it preserves legitimate communications, and whether it can be operated without creating a new review burden. That framing is more defensible than comparing products on generic block rates, because it reflects the real risk left in the environment. Practitioners should evaluate email security as a residual-risk control, not a standalone shield.

From our research library:

• Security researchers tracked consent phishing campaigns affecting 900 tenants and 3,000 user accounts in 2025.

What this signals

Residual-risk governance will become the default lens for email security. Teams should expect evaluation criteria to shift away from standalone detection claims and toward measurable additive protection over Microsoft 365, especially where business email continuity matters. That means procurement, SOC operations, and tenant administration need a shared view of what the second layer is actually buying.

False-positive management is now a control objective in its own right. Email security programmes that cannot preserve legitimate traffic will eventually be bypassed, tolerated, or overruled. The practical implication is that teams should formalise tolerance thresholds, review escalation paths, and quarantine ownership before they scale an add-on layer across the tenant.

For practitioners

• Define success as residual-risk reduction Measure email security products against the messages Microsoft 365 lets through, not against all inbound mail, and require that metric in proof-of-value testing.
• Validate false-positive tolerance with live traffic Test legitimate mail handling using real business samples, then set an acceptance threshold that reflects the support burden your team can absorb.
• Review delegated tenant permissions If the product connects through API, document the mailbox scopes, remediation actions, and audit trail required for least-privilege operation.
• Separate routing decisions from remediation decisions Decide whether the control should inspect, quarantine, or remove mail without changing the transport path, then map that choice to operational ownership.

Key takeaways

• The core issue is not whether Microsoft 365 filters email, but how much harmful traffic still reaches users after native controls have already done their job.
• Independent testing matters because it measures detection against live residual mail, where the real inbox risk remains.
• Email security buyers should balance additive threat detection against the operational cost of false positives and quarantine handling.

Related NHI Mgmt Group resources: Microsoft 365 Security Guide · Alert Triage Guide · Email Security Guide

Key terms

• Incremental Detection Rate: Incremental detection rate measures how much threat traffic a layered control catches after a base platform has already filtered what it can. It is the right way to judge add-on email security because it isolates the residual risk that would otherwise reach users.
• False Positive: A false positive is a scanner result that looks like a secret but is not actually sensitive. In secret governance, false positives matter because they consume analyst time, weaken trust in alerts, and can delay response to the findings that truly change exposure and access risk.
• Residual Risk: Residual risk is the risk that remains after controls are applied. In identity-heavy environments, it often reflects over-permissioning, stale accounts, and exceptions that were accepted but never truly removed, which means the real exposure can be higher than the documented policy baseline.
• API-Based Email Security: API-based email security integrates with the mail platform through application interfaces rather than sitting in front of traffic. This lets security teams inspect delivered messages, automate remediation, and connect email actions to mailbox and identity context in cloud-native environments.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. Explore training when your programme needs a stronger identity lens on access, credentials, and governance.