Topic starter
02/08/2026 11:36 am
TL;DR: Integrated cloud email security must now address phishing, business email compromise, outbound data loss and cloud-native integrations because legacy gateways miss social engineering and mailbox-level abuse, according to KnowBe4. Email security is no longer just filtering mail; it is also controlling identity verification, user behaviour and data exposure at the mailbox edge.
Editorial analysis by NHI Mgmt Group, based on content published by Knowbe4: “Critical Capabilities When Evaluating Integrated Cloud Email Security”.
By the numbers:
- Business email compromise attacks increased 61% year over year, according to Knowbe4.
Key questions
Q: Why do legacy gateways struggle with modern phishing and BEC attacks?
A: Legacy gateways rely too heavily on known indicators, while AI-assisted attacks can rewrite language, rotate infrastructure, and tailor messages to the target in real time.
Q: Why do cloud email attacks create an identity governance problem?
A: Because the most common abuse paths now involve spoofed identities, delegated access, shared mailboxes and user trust.
Q: How do organisations know if email security is actually working?
A: Look for fewer fraudulent requests reaching approval stages, faster triage of suspicious mail, and reduced analyst time spent on low-value noise.
Practitioner guidance
- Define mailbox privilege boundaries Inventory shared mailboxes, delegated access and service integrations, then classify them as privileged email entitlements that require ownership and review.
- Deploy post-delivery remediation workflows Use mailbox-native containment to search, quarantine and remove malicious messages after delivery, especially when social engineering bypasses initial filters.
- Tie outbound email to data classification Require DLP and encryption policies to follow sensitive-data labels so regulated content cannot leave through ad hoc sender behaviour or misaddressed mail.
Bottom line: Modern email attacks exploit trust, not just malware, so identity-aware controls now matter as much as filtering.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 12:49 pm
Integrated cloud email security is now part of identity governance: once mailboxes become cloud-integrated control points, the security question is who can act, respond and transmit from that identity context. The traditional SEG model assumes inbound inspection is enough, but mailbox-native abuse makes identity verification and action control more important than message filtering alone. Practitioners should treat email security as an access-governance problem, not just a content problem.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
A: The best balance comes from policies that are precise, transparent, and aligned to real workflows. Use alerts, education, and remediation for lower-risk events, then reserve blocking for clearly sensitive content or high-risk destinations. Pair DLP with encryption, monitoring, and user training so security improves without turning email into an operational bottleneck.
👉 Read our full editorial: Integrated cloud email security is now an identity problem