Topic starter
02/08/2026 11:54 am
TL;DR: Despite heavy investment in secure email gateways, 94% of organisations still report email security incidents and 87% of cybersecurity leaders are considering replacing SEGs, while advanced phishing attacks bypass detection more often, according to KnowBe4. Static DLP and gateway-centric controls are no longer enough when email risk spans identity, content, and user behaviour.
Editorial analysis by NHI Mgmt Group, based on content published by Knowbe4: “Whitepaper Are You Ready to Replace Your SEG?”.
By the numbers:
- 87% of cybersecurity leaders are now looking to replace their secure email gateways.
- Advanced phishing attacks are bypassing SEG detection more often, with a 47% increase in attacks getting through detection.
Key questions
Q: Why do secure email gateways miss phishing campaigns that use legitimate third-party services?
A: Secure email gateways miss these campaigns because they are built around static rules, keyword checks, and allowlists.
Q: When should organisations replace static DLP in email security?
A: Replace static DLP when your main outbound risks are misdirected emails, human error, and context-heavy disclosure that rules cannot interpret reliably.
Q: What breaks when secure email gateways are the main email security control?
A: When SEGs are treated as the main control, organisations often miss identity-based phishing, internal impersonation, and outbound leakage driven by human error.
Practitioner guidance
- Reassess SEG dependency against actual incident outcomes Compare the incidents your SEG missed against the attack types the gateway was designed to stop.
- Add identity-aware controls to email workflows Use sender authentication, recipient validation, and user-risk signals to make email decisions based on identity context rather than only message content.
- Replace static DLP rules with contextual outbound controls Tune outbound protection for recipient sensitivity, message context, and workflow state so that human error and data loss are evaluated in context.
Bottom line: Email security incidents persist because SEGs do not govern the full trust decision that happens after delivery.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:03 pm
Email security has become an identity governance problem, not just a mail filtering problem. The article shows that the control boundary has shifted beyond the inbox perimeter. Once attackers rely on impersonation, trust abuse, and social engineering, the deciding control is whether identity signals and user context are available at the point of action. Practitioners should therefore judge email security by how well it governs trust decisions, not only by how many messages a gateway blocks.
A few things that frame the scale:
- Organisations that rely heavily on static credentials reported a 20-percentage-point increase in security incidents compared with those with low reliance, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What should security teams do when SEG coverage and incident rates diverge?
A: Treat the divergence as evidence that the control model is too narrow. Review which incidents bypassed the SEG, which were caused by user action, and which required downstream containment. Then align email controls to identity signals, outbound context, and response ownership so protection reflects how the threat actually works.
👉 Read our full editorial: Email security incidents persist despite SEGs, driving ICES adoption