Direct Send abuse in manufacturing: are your mail controls keeping up?

TL;DR: Manufacturing remains the most-attacked industry for a fifth straight year, while its case flow shows phishing landing on more distinct manufacturers each week and recurring abuse of Microsoft 365 Direct Send, credential harvesting, vendor impersonation, and invoice fraud, according to IRONSCALES.

Editorial analysis by NHI Mgmt Group, based on content published by IRONSCALES: “Why Attackers Target Manufacturers, and What the Attacks Look Like”.

By the numbers:

• Manufacturing accounts for 27.7% of incidents in IBM's 2026 X-Force Threat Intelligence Index.
• Business email compromise cost victims $3.04 billion in reported losses in 2025, per the FBI's IC3 annual report cited by IRONSCALES.

Key questions

Q: What breaks when Direct Send is left open in Microsoft 365?

A: When Direct Send remains open, unauthenticated mail can enter the tenant looking like internal or trusted partner traffic.

Q: Why do high-volume phishing campaigns that steal credentials often lead to payment fraud and invoice abuse?

A: They create immediate access to real conversations, vendor relationships, and financial context.

Q: What are the signs that vendor impersonation is succeeding even when authentication passes?

A: Look for payment-change requests, urgent invoice revisions, or banking updates from senders that are technically authenticated but inconsistent with normal supplier behaviour.

Practitioner guidance

• Disable unauthenticated Direct Send where feasible Turn on RejectDirectSend and verify which devices or applications actually depend on the feature before leaving it enabled.
• Enforce DMARC on your own and supplier domains Move internal domains to enforcement and push key suppliers toward the same posture so spoofed or lookalike domains lose value.
• Monitor behaviour for authenticated but suspicious mail Build detections for mail that passes SPF, DKIM, and DMARC yet arrives with abnormal sender behaviour, unusual volume, or a role that should not be generating human-like requests.

Bottom line: Manufacturing email defence fails when teams rely on technical message validity alone, because authenticated mail can still carry fraudulent intent.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →