Notifications
Clear all
Topic starter
14/07/2026 4:22 pm
TL;DR: Email remains a primary path for phishing and business email compromise, but the stronger finding is that security failures often come from architecture, identity controls, and framing rather than awareness alone, according to Proofpoint. The control gap is less about user education and more about reducing trust in messages, accounts, and delegated access before attackers turn email into account takeover.
NHIMG editorial — based on content published by Proofpoint: How a Technology Company Closed the Gaps Cisco IronPort Couldn't and Finally Got Ahead of Phishing and BEC Cyberthreats
Questions worth separating out
Q: What breaks when email is treated as a trusted identity signal?
A: When email is treated as authoritative, attackers can use one compromised or impersonated mailbox to trigger password resets, approve fraudulent requests, or alter delegated access.
Q: Why does phishing remain effective even when employees are trained?
A: Phishing remains effective because attackers exploit urgency, familiarity, and normal business processes, which can overwhelm training in the moment.
Q: What do security teams get wrong about email encryption?
A: They often treat encryption as if it alone proves trust.
Practitioner guidance
- Tighten mailbox-to-identity links Inventory where email access can trigger password resets, MFA recovery, delegated access, or privileged workflow approvals.
- Require out-of-band verification Make payment changes, supplier edits, support escalations, and privileged requests require a second verified channel that is independent of email.
- Audit delegated access and OAuth grants Review mailbox rules, forwarding, app consents, and delegated permissions that let an attacker pivot from email into connected services.
What's in the full article
Proofpoint's full article covers the operational detail this post intentionally leaves for the source:
- How the vendor frames email security architecture changes for phishing and BEC defence in practice.
- The specific control patterns it recommends for reducing trust in email-driven decisions.
- Operational examples showing where email awareness programs fail without identity and workflow controls.
- The article’s own framing of why frontier AI-era email threats need a different architecture.
👉 Read Proofpoint's analysis of why email security architecture matters for phishing and BEC →
Email security architecture and BEC risk: what should teams change?
Explore further
14/07/2026 4:30 pm
Email security is now an identity governance problem, not just a messaging problem. Phishing and BEC succeed when the mailbox is treated as a trusted channel rather than a governed access surface. The most dangerous part is the identity adjacency: email can trigger password resets, approval workflows, delegated access, and fraud decisions. Practitioners should assess email as part of the identity control plane, not as a standalone awareness issue.
A question worth separating out:
Q: How can organisations reduce BEC risk without slowing legitimate work?
A: Use risk-based verification for high-value transactions, privileged changes, and sensitive requests rather than applying the same friction everywhere. The goal is to make high-impact actions harder to fake while keeping routine work efficient. That means stronger validation where trust has financial consequence.
👉 Read our full editorial: Email security architecture is the real gap in phishing and BEC
