SEG miss rates expose a widening gap in MSP email defence

At a glance

What this is: IRONSCALES says traditional SEG controls are missing large volumes of phishing traffic, especially against impersonation, credential theft, and business email compromise.

Why it matters: This matters to IAM and security teams because email remains a primary identity attack surface, and missed messages can quickly turn into account takeover, fraud, and remediation burden.

By the numbers:

• On average, SEGs miss 67.5 phishing emails per 100 mailboxes every month.
• Vendor scams represent 30-40% of missed attacks across major SEG providers.
• Credential theft attacks make up another 21-41% of what's slipping through.

Context

Secure email gateways were built to catch obvious malicious mail at the perimeter, but modern phishing campaigns increasingly succeed by looking legitimate and avoiding signature-based detection. In MSP environments, that creates a governance gap: the control can appear active while high-risk messages still reach the inbox.

For managed service providers, the problem is not only technical detection but also client trust and operational load. When impersonation or credential-harvest emails bypass filtering, the service desk inherits the cleanup, and the provider inherits the blame. That makes email defence a service assurance issue as much as a security tool choice.

Key questions

Q: What breaks when a legacy email gateway is the only line of defence against modern phishing?

A: Legacy gateways tend to fail when phishing is delivered with delayed links, impersonation, or no-payload business email compromise. They are built to judge messages at the edge, but modern attacks often become dangerous only after delivery. That leaves security teams cleaning up inboxes after users have already interacted with messages instead of preventing exposure up front.

Q: Why do impersonation emails create more risk than obvious spam?

A: Because they exploit trust rather than noise. A convincing vendor invoice, executive request, or login prompt can pass technical checks and still manipulate a user into acting. The risk is higher because the attacker does not need malware to succeed. They only need the recipient to believe the message is normal and proceed without challenge.

Q: How do security teams know whether their MSP controls are actually working?

A: They should test whether access can be explained, monitored, and removed at the same speed it is granted. If logs, approval records, and offboarding actions do not line up, the control environment is too fragmented to satisfy regulatory scrutiny. The clearest signal is whether a privilege review produces usable evidence, not just a checklist.

Q: Should teams keep perimeter filtering or move to inbox-level protection?

A: They should keep both where possible, but the centre of gravity has shifted. Perimeter filtering remains useful for commodity threats, yet modern phishing often succeeds after it passes that layer. Teams should prioritise inbox-aware detection and response when their users face impersonation, credential theft, or repeated BEC attempts.

Technical breakdown

Why perimeter email filtering misses modern impersonation campaigns

Traditional secure email gateways rely heavily on known indicators, signatures, sender reputation, and rule-based verdicts. That works best against commodity spam and straightforward malware delivery, but impersonation campaigns exploit trusted language, familiar brands, and low-noise social engineering. When the message body is the attack vehicle, perimeter controls often lack enough context to judge intent. The failure is not just coverage, but latency: by the time a sender pattern becomes suspicious, the message may already have been delivered to the mailbox. See the Email Security Guide.

Practical implication: treat perimeter filtering as one layer, not the final control for socially engineered email threats.

Why credential theft and BEC bypass legacy rules

Credential theft and business email compromise attacks often avoid malicious attachments and obvious payloads, which reduces the chance of triggering classic gateway rules. They frequently use urgent language, lookalike login pages, or trusted-thread hijacking to manipulate the recipient into acting. Because the maliciousness sits in context rather than code, detection depends on behavioural analysis, identity signals, and message relationship mapping rather than static content inspection alone. This is why mailbox-level controls have become more important than perimeter-only inspection. See the Phishing Incident Response Playbook.

Practical implication: combine content inspection with inbox-aware detection that can evaluate identity and conversation context.

Threat narrative

Attacker objective: The attacker wants money, credentials, or a trusted foothold inside the customer environment while avoiding early detection.

1. Entry occurs through a convincing phishing or impersonation email that reaches the mailbox because the SEG does not recognise it as malicious.
2. Credential harvesting or fraud follows when the recipient clicks a login lure, pays a fake invoice, or responds to a fraudulent executive request.
3. Impact is account compromise, financial loss, incident response effort, and client trust damage that lands on the MSP as the service provider.

Breaches seen in the wild

• Entra ID actor token flaw (CVE-2025-55241): Hidden Actor tokens plus an Azure AD Graph validation flaw could have let attackers become Global Admin in any Entra ID tenant (CVE-2025-55241).

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

SEG miss rates have become a governance problem, not just a detection problem. When a gateway misses dozens of phishing messages per 100 mailboxes each month, the control is no longer providing the assurance an MSP is selling to its customers. The issue is not whether filtering exists, but whether the control objective matches the current threat model. Practitioners should treat missed message volume as evidence that the perimeter has stopped being the right control boundary.

Impersonation is the defining failure mode in modern email defence. The article's mix of vendor scams, credential theft, and business email compromise shows that attackers are optimising for human trust rather than malware delivery. That shifts the problem toward identity validation inside the email flow, including sender authenticity, conversation context, and user-action risk. Teams that still optimise only for spam reduction are measuring the wrong outcome.

Identity-context email defence is the real control gap here. Email attacks now exploit the relationship between sender, brand, and recipient expectation, which means the security decision depends on identity trust signals as much as content analysis. phishing incident response playbook matters here because MSPs need response discipline when the control boundary fails, not only better filtering. The practical conclusion is that email security strategy now belongs in identity and access governance discussions, not only in mail admin tooling.

MSPs face asymmetric liability when email attacks succeed. The customer sees a breach, but the provider absorbs the operational burden, reputational damage, and competitive comparison. That means email security capability is part of service differentiation and contract risk, not just a technical stack decision. Practitioners should evaluate whether their current controls can sustain a breach inquiry, not merely pass a product review.

From our research library:

• Impersonation fraud accounted for over 85% of all fraud attacks in 2025.
• Read next: Phishing Incident Response Playbook

What this signals

Identity-context email defence: modern phishing succeeds by exploiting sender trust, brand familiarity, and message context, so the control problem has moved inside the inbox. That means MSPs should track not just block rates but whether their controls can identify fraudulent intent before a user acts.

The operational signal to watch is remediation burden, because every missed email turns into mailbox review, credential reset, or client communication work. According to the 2024 State of Secrets Management Survey, the average time to mitigate a leaked secret is 36 hours, which is the kind of delay that turns detection gaps into sustained operational drag.

For practitioners

• Reassess SEG effectiveness against modern impersonation Measure how many vendor scams, credential theft attempts, and BEC messages reach the inbox despite your current gateway policy set.
• Add inbox-level behavioural detection Use controls that inspect conversation patterns, sender behaviour, and recipient context instead of relying only on signatures and reputation.
• Map missed messages to service risk Track how many incidents become support tickets, remediation calls, or customer escalations so email security failure is visible in business terms.
• Test incident response for phishing fallout Validate who can quarantine mail, revoke tokens, reset credentials, and communicate with clients when a phishing message succeeds.

Key takeaways

• Traditional SEG filtering can miss enough realistic phishing to create a service assurance problem, not just a technical detection gap.
• The article's evidence points to impersonation, credential theft, and BEC as the dominant threat patterns behind missed mail.
• MSPs need inbox-aware detection and response if they want to reduce both customer exposure and the manual remediation burden.

Related NHI Mgmt Group resources: Email Security Guide · Phishing Incident Response Playbook · MITRE ATT&CK Guide for Defenders

Key terms

• Phishing Impersonation: A social engineering technique that copies the identity, language, and workflow of a trusted organisation to trick recipients into acting. In eSignature attacks, the goal is usually to induce document signing, payment approval, or credential entry by making the request appear routine, urgent, and operationally legitimate.
• Business email compromise: A form of social engineering where an attacker impersonates a trusted person or domain to manipulate payment, change banking details, or extract sensitive information. It often succeeds without malware because the attacker targets process trust and human judgement instead of technical controls.
• Secure Email Gateway: A secure email gateway is a control layer that inspects email before it reaches users and can also inspect outbound mail. It filters malicious content, enforces policy, and reduces exposure to phishing, malware, and data leakage, but it does not replace identity governance or account monitoring.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. It is a practical starting point for teams that need to connect identity risk to operational security decisions.