SEG miss rates for MSPs: what does this mean for client risk?

TL;DR: Across nearly 2,000 customer environments, SEGs miss 67.5 phishing emails per 100 mailboxes each month, with small businesses facing up to 7.5 times more missed attacks than large enterprises, according to IRONSCALES research. Static perimeter filtering is now a liability when impersonation, credential theft, and BEC are designed to evade legacy signatures.

Editorial analysis by NHI Mgmt Group, based on content published by IRONSCALES: “Love is Blind, But Your SEG Gap Analysis Shouldn't Be”.

By the numbers:

• On average, SEGs miss 67.5 phishing emails per 100 mailboxes every month.
• Vendor scams represent 30-40% of missed attacks across major SEG providers.
• Credential theft attacks make up another 21-41% of what's slipping through.

Key questions

Q: What breaks when a legacy email gateway is the only line of defence against modern phishing?

A: Legacy gateways tend to fail when phishing is delivered with delayed links, impersonation, or no-payload business email compromise.

Q: Why do impersonation emails create more risk than obvious spam?

A: Because they exploit trust rather than noise.

Q: How do security teams know whether their MSP controls are actually working?

A: They should test whether access can be explained, monitored, and removed at the same speed it is granted.

Practitioner guidance

• Reassess SEG effectiveness against modern impersonation Measure how many vendor scams, credential theft attempts, and BEC messages reach the inbox despite your current gateway policy set.
• Add inbox-level behavioural detection Use controls that inspect conversation patterns, sender behaviour, and recipient context instead of relying only on signatures and reputation.
• Map missed messages to service risk Track how many incidents become support tickets, remediation calls, or customer escalations so email security failure is visible in business terms.

Bottom line: Traditional SEG filtering can miss enough realistic phishing to create a service assurance problem, not just a technical detection gap.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →