Topic starter
14/07/2026 4:24 pm
TL;DR: A construction services firm found that layering Barracuda with Abnormal still left phishing, spam, and account takeover attempts reaching inboxes and downstream SaaS apps, according to Proofpoint. The case shows that post-delivery detection alone does not close identity abuse and collaboration risk gaps.
Editorial analysis by NHI Mgmt Group, based on content published by Proofpoint: “Construction firm ditches Abnormal and Barracuda for Proofpoint to stop email threats for good”.
Key questions
A: Threats are more likely to reach users before defenders can intervene, especially social engineering and links that look legitimate at first glance.
Q: Why does account takeover make phishing harder to stop?
A: Account takeover is dangerous because the attacker sends from a valid, trusted identity.
Q: What signs show that email identity controls are not keeping pace?
A: Watch for stale shared mailboxes, persistent delegated send permissions, accounts that remain active after role change, and alerts that show unusual sending behaviour from trusted identities.
Practitioner guidance
- Strengthen pre-delivery phishing controls Prioritise controls that block malicious messages before they reach users, especially for high-value mailboxes and distributed project teams.
- Tie account takeover alerts to identity containment When compromise is suspected, trigger session isolation, password reset, token revocation and SaaS access review together so the account cannot continue operating across collaboration tools.
- Review downstream SaaS exposure paths Map which collaboration and business applications can be reached from a compromised email identity, then identify where an attacker could pivot after a successful login or token reuse.
Bottom line: The article shows that layering email tools can still leave phishing and account takeover paths open when controls only react after delivery.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/07/2026 4:32 pm
Account takeover has become an identity governance problem disguised as an email problem. The article shows that message-layer controls can still leave the actual trust boundary untouched when the user identity itself is compromised. Once a legitimate account is abused, downstream SaaS access, shared workspaces and approvals all inherit the risk. Practitioners should treat account takeover as a cross-domain identity event, not just a mail hygiene failure.
A question worth separating out:
Q: How should teams respond when compromised email accounts can reach SaaS applications?
A: Teams should isolate the account, revoke active sessions and tokens, and review which SaaS applications inherit access from that identity before the attacker can move laterally. The goal is to stop the compromised account from acting as a bridge into collaboration and business systems. Containment has to happen at the identity layer, not only in the mail flow.
👉 Read our full editorial: Email security layering is failing account takeover defense in SaaS