Layered email security for Microsoft 365: what the residual risk looks like

TL;DR: Virus Bulletin's first VB ESA - M365 certification with zero false positives and a 100% detection rate against malware that Microsoft 365 allowed through shows the value of additive filtering beyond native protection, according to Coro research. The result reinforces that email controls must be measured on residual risk, not on standalone block rates.

Editorial analysis by NHI Mgmt Group, based on content published by Coro: “Coro Email Security Earns VB ESA M365 Certification”.

By the numbers:

• Virus Bulletin ran a continuous stream of live email through a Microsoft 365 tenant over 17 days.
• Coro Email Security recorded zero false positives across the 371 legitimate messages that reached it.
• Coro Email Security caught 99 of the 108 spam messages that made it past Microsoft 365's native filtering.

Key questions

Q: How should security teams evaluate email protection when Microsoft 365 is part of the stack?

A: They should test whether all inbound mail is routed through the same inspection path, then compare the same threat set across products and time periods.

Q: Why do false negatives matter more than false positives in email security operations?

A: False negatives matter because they let malicious messages reach users and create real compromise risk, including credential theft and account takeover.

Q: What breaks when an email security layer is tuned too aggressively?

A: Business communications break first.

Practitioner guidance

• Define success as residual-risk reduction Measure email security products against the messages Microsoft 365 lets through, not against all inbound mail, and require that metric in proof-of-value testing.
• Validate false-positive tolerance with live traffic Test legitimate mail handling using real business samples, then set an acceptance threshold that reflects the support burden your team can absorb.
• Review delegated tenant permissions If the product connects through API, document the mailbox scopes, remediation actions, and audit trail required for least-privilege operation.

Bottom line: The core issue is not whether Microsoft 365 filters email, but how much harmful traffic still reaches users after native controls have already done their job.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →