Notifications
Clear all
Topic starter
14/07/2026 4:24 pm
TL;DR: A construction services firm found that layering Barracuda with Abnormal still left phishing, spam, and account takeover attempts reaching inboxes and downstream SaaS apps, according to Proofpoint. The case shows that post-delivery detection alone does not close identity abuse and collaboration risk gaps.
NHIMG editorial — based on content published by Proofpoint: a construction firm's email security evaluation and consolidation decision
Questions worth separating out
Q: What breaks when organisations rely on post-delivery email detection alone?
A: Post-delivery detection leaves a window where phishing can reach users before remediation begins.
Q: Why do compromised identities matter so much in email security?
A: Because a trusted account can move from email into collaboration tools, SaaS apps, and financial workflows without triggering the same suspicion as an external attacker.
Q: How do security teams know if their email controls are actually overlapping?
A: Look for the same threat categories being claimed by both layers, the same messages being inspected twice, and the same native protections being disabled to keep the SEG functional.
Practitioner guidance
- Test pre-delivery blocking against evasive phishing Run controlled simulations to measure whether malicious mail is stopped before user exposure rather than only quarantined after delivery.
- Link account takeover detection to application lockout Ensure suspicious mailbox activity can trigger SaaS session revocation, MFA reset review, and access suspension across collaboration tools.
- Review supplier identity paths in collaboration tools Identify which external accounts can influence internal decisions, then apply stricter verification to payment, procurement, and contract-related channels.
What's in the full article
Proofpoint's full article covers the operational detail this post intentionally leaves for the source:
- The evaluation criteria used to compare pre-delivery and post-delivery detection against phishing and account takeover.
- The role of application lockout and automated remediation in containing compromised SaaS access.
- The supplier threat visibility features that informed the firm's consolidation decision.
- The practical differences between running stacked point tools and operating under a unified collaboration security model.
👉 Read Proofpoint's analysis of layered email security gaps and account takeover risk →
Email security layering and account takeover: what teams are missing?
Explore further
14/07/2026 4:32 pm
Email security layering often reduces overlap without reducing exposure. This case shows that adding an API-based layer on top of a secure email gateway can create more consoles and more alerts without reliably shrinking the attack window. The governance problem is not tool count, but whether the control stack stops malicious messages before users and identities are put at risk. For practitioners, the lesson is to test control composition, not assume it.
A question worth separating out:
Q: Who is accountable when a compromised mailbox leads to SaaS abuse?
A: Accountability usually sits across email security, IAM, and application owners because the incident spans message filtering, identity compromise, and downstream access. Organisations should define who can revoke sessions, who owns recovery controls, and who confirms third-party exposure when the mailbox is used as a trust anchor.
👉 Read our full editorial: Email security layering is failing account takeover defense in SaaS
