Topic starter
14/07/2026 4:24 pm
TL;DR: Web applications use email addresses as the primary identifier for critical functions in 64.9% to 92.4% of cases, while Proofpoint reports 59% of compromised accounts still had MFA enabled and 54% of ransomware victims had stolen credentials first. The security problem is no longer inbox protection alone, but identity governance for both humans and the AI systems acting on their behalf.
Editorial analysis by NHI Mgmt Group, based on content published by Proofpoint: “I email, therefore I am: why email remains at the core of human and agentic identity”.
By the numbers:
- Between 64.9% and 92.4% of web applications use email addresses as the primary identifier for critical functions such as account creation and password recovery.
- Proofpoint found that 59% of compromised accounts still had MFA enabled, showing that stronger authentication alone does not stop identity compromise.
Key questions
Q: What breaks when email is treated as the primary identity for both users and agents?
A: Recovery, authentication, and delegated action all collapse into one trust channel, so a mailbox compromise can reset access across many systems and trigger automated actions.
Q: Why do compromised-password checks matter if MFA is already deployed?
A: MFA reduces some account takeover paths, but it does not make a reused or breached password harmless.
Q: How can security teams tell whether email recovery is creating too much risk?
A: Look for high-value applications that still use email for password reset, enrolment confirmation, or ownership proof.
Practitioner guidance
- Map every email-based recovery path Inventory where email can reset passwords, approve enrolment, or restore access, then remove it from high-value accounts where possible.
- Classify agent inboxes as privileged identities Treat any AI system that reads or sends email as a governed identity with explicit ownership, scoped access, and revocation controls.
- Test identity compromise beyond MFA Simulate token theft, recovery abuse, and session replay so detection and response can catch takeover even when a second factor exists.
Bottom line: Email has evolved from a communication channel into a high-value identity layer that connects login, recovery, and delegated action.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/07/2026 5:06 pm
Email identity has become an identity governance surface, not just a security control point. The article is right to frame email as the de facto digital identifier, because recovery, authentication, and cross-service linkage all converge there. That makes mailbox governance, recovery design, and identity verification part of the same control plane. The practitioner conclusion is that email must be governed as identity infrastructure, not treated as a communication asset.
A few things that frame the scale:
- Stolen credentials were involved in 22% of breaches overall and in 88% of basic web application attacks, according to Verizon's 2025 Data Breach Investigations Report.
A question worth separating out:
Q: How should organisations govern AI assistants that can read and act on inbox messages?
A: They should define those assistants as delegated non-human identities with explicit message scope, action scope, and escalation limits. The goal is to prevent natural-language instructions from becoming unauthorised workflow triggers. Review what the agent can read, what it can do, and what requires human confirmation.
👉 Read our full editorial: Email identity is becoming a shared attack surface for humans and agents