Topic starter
25/10/2026 11:06 am
TL;DR: 67.5 phishing emails per 100 mailboxes each month is what IRONSCALES telemetry found SEGs miss across nearly 2,000 customer environments. MSP email defence needs inbox-aware detection and response when impersonation, credential theft, and BEC slip past perimeter filtering.
Editorial analysis by NHI Mgmt Group, based on content published by IRONSCALES: “Love is Blind, But Your SEG Gap Analysis Shouldn't Be”.
By the numbers:
- On average, SEGs miss 67.5 phishing emails per 100 mailboxes every month.
- Vendor scams represent 30-40% of missed attacks across major SEG providers.
- Credential theft attacks make up another 21-41% of what's slipping through.
Key questions
Q: Why do impersonation emails create more risk than obvious spam?
A: Because they exploit trust rather than noise.
Q: How do security teams know whether their MSP controls are actually working?
A: They should test whether access can be explained, monitored, and removed at the same speed it is granted.
Q: What breaks when a legacy email gateway is the only line of defence against modern phishing?
A: Legacy gateways tend to fail when phishing is delivered with delayed links, impersonation, or no-payload business email compromise.
Practitioner guidance
- Reassess SEG effectiveness against modern impersonation Measure how many vendor scams, credential theft attempts, and BEC messages reach the inbox despite your current gateway policy set.
- Add inbox-level behavioural detection Use controls that inspect conversation patterns, sender behaviour, and recipient context instead of relying only on signatures and reputation.
- Map missed messages to service risk Track how many incidents become support tickets, remediation calls, or customer escalations so email security failure is visible in business terms.
Bottom line: Traditional SEG filtering can miss enough realistic phishing to create a service assurance problem, not just a technical detection gap.
Glossary terms: Phishing Impersonation, Business email compromise, Secure Email Gateway
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 days ago by NHI Mgmt Group
27/10/2026 7:17 pm
SEG miss rates have become a governance problem, not just a detection problem. When a gateway misses dozens of phishing messages per 100 mailboxes each month, the control is no longer providing the assurance an MSP is selling to its customers. The issue is not whether filtering exists, but whether the control objective matches the current threat model. Practitioners should treat missed message volume as evidence that the perimeter has stopped being the right control boundary.
A few things that frame the scale:
- Impersonation fraud accounted for over 85% of all fraud attacks in 2025.
A question worth separating out:
Q: Should teams keep perimeter filtering or move to inbox-level protection?
A: They should keep both where possible, but the centre of gravity has shifted. Perimeter filtering remains useful for commodity threats, yet modern phishing often succeeds after it passes that layer. Teams should prioritise inbox-aware detection and response when their users face impersonation, credential theft, or repeated BEC attempts.
👉 Read our full editorial: SEG miss rates expose a widening gap in MSP email defence
This post was modified 7 days ago by NHI Mgmt Group