Topic starter
02/08/2026 11:36 am
TL;DR: Modern email attacks exploit trust, not just malware, and KnowBe4 says that makes identity-aware controls as important as filtering. Email security now has to govern mailbox access and user behaviour as well as message inspection.
Editorial analysis by NHI Mgmt Group, based on content published by Knowbe4: “Critical Capabilities When Evaluating Integrated Cloud Email Security”.
By the numbers:
- Business email compromise attacks increased 61% year over year, according to Knowbe4.
Key questions
Q: Why do cloud email attacks create an identity governance problem?
A: Because the most common abuse paths now involve spoofed identities, delegated access, shared mailboxes and user trust.
Q: How do organisations know if email security is actually working?
A: Look for fewer fraudulent requests reaching approval stages, faster triage of suspicious mail, and reduced analyst time spent on low-value noise.
Q: Why do legacy gateways struggle with modern phishing and BEC attacks?
A: Legacy gateways rely too heavily on known indicators, while AI-assisted attacks can rewrite language, rotate infrastructure, and tailor messages to the target in real time.
Practitioner guidance
- Define mailbox privilege boundaries Inventory shared mailboxes, delegated access and service integrations, then classify them as privileged email entitlements that require ownership and review.
- Deploy post-delivery remediation workflows Use mailbox-native containment to search, quarantine and remove malicious messages after delivery, especially when social engineering bypasses initial filters.
- Tie outbound email to data classification Require DLP and encryption policies to follow sensitive-data labels so regulated content cannot leave through ad hoc sender behaviour or misaddressed mail.
Bottom line: Modern email attacks exploit trust, not just malware, so identity-aware controls now matter as much as filtering.
Glossary terms: Business email compromise, Post-delivery Protection, Mailbox privilege sprawl, Outbound Data Loss Prevention
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
02/08/2026 12:49 pm
Integrated cloud email security is now part of identity governance: once mailboxes become cloud-integrated control points, the security question is who can act, respond and transmit from that identity context. The traditional SEG model assumes inbound inspection is enough, but mailbox-native abuse makes identity verification and action control more important than message filtering alone. Practitioners should treat email security as an access-governance problem, not just a content problem.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
A: The best balance comes from policies that are precise, transparent, and aligned to real workflows. Use alerts, education, and remediation for lower-risk events, then reserve blocking for clearly sensitive content or high-risk destinations. Pair DLP with encryption, monitoring, and user training so security improves without turning email into an operational bottleneck.
👉 Read our full editorial: Integrated cloud email security is now an identity problem