Topic starter
14/07/2026 4:21 pm
TL;DR: The 2026 Verizon DBIR found the human element was present in 62% of breaches, while Proofpoint says its aggregated assessments across 696 deployments showed a median 27.1% of threats blocked by Proofpoint bypassed Microsoft, highlighting how measurement point and mail flow architecture change what efficacy numbers actually mean. Partial visibility distorts buying decisions, and pre-delivery versus post-delivery controls now matter as much as detection accuracy.
Editorial analysis by NHI Mgmt Group, based on content published by Proofpoint: “Seeing the Full Picture: How to Measure Email Security Effectiveness the Right Way”.
By the numbers:
- The 2026 Verizon DBIR showed the human element was present in 62% of breaches.
- Proofpoint said its median customer running Proofpoint in front of Microsoft Defender catches an additional 27.1% of threats.
- Proofpoint said customers behind Microsoft see a median of 408 advanced threats delivered per 1,000 users.
Key questions
Q: What breaks when email security measurements only count threats that reached the mailbox layer?
A: You lose the upstream threats that were already blocked, so the score no longer reflects total protection.
A: Security teams should treat email security as a continuous control surface, not two disconnected tools.
Q: What are the signs that an email benchmark is missing hidden threats?
A: Look for reports that only describe delivered mail, only show remediated messages, or cannot explain where in the mail flow measurement occurred.
Practitioner guidance
- Measure from the same inspection point Run side-by-side evaluations only when both products inspect the same inbound mail population, with identical time windows and exportable raw data.
- Separate prevention from cleanup Track pre-delivery blocks, post-delivery remediations, and user-exposure dwell time as separate outcomes so the metrics do not collapse into one score.
- Close direct-send bypass paths Review Direct Send, tenant-to-tenant delivery, and other internal routing paths so messages cannot avoid inspection before reaching users.
Bottom line: Email security metrics can be misleading when upstream blocks never enter the benchmark view.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/07/2026 4:29 pm
Measurement point is now a governance control, not just an analytics choice. Email security scores are only meaningful when practitioners know whether they measure upstream prevention, mailbox-layer residue, or post-delivery cleanup. Once different vendors are measuring different populations, the benchmark stops comparing protection and starts comparing architecture. For security leaders, the decision is whether the evaluation captures the entire inbound threat stream or only what survived someone else’s controls.
A question worth separating out:
Q: How should security teams evaluate email protection when Microsoft 365 is part of the stack?
A: They should test whether all inbound mail is routed through the same inspection path, then compare the same threat set across products and time periods. If Microsoft sits behind an upstream gateway, mailbox-native numbers alone will understate the amount of malicious traffic already stopped before delivery.
👉 Read our full editorial: Email security benchmarks expose the hidden cost of partial visibility