Topic starter
27/06/2026 1:42 pm
TL;DR: Email security gaps now extend beyond the inbox, because phishing and BEC messages auto-forwarded into CRMs or ticketing tools can persist after remediation and remain visible to users with no threat context, according to Abnormal AI. The real control problem is upstream inspection across forwarding paths, not just inbox cleanup.
Editorial analysis by NHI Mgmt Group, based on content published by Abnormal AI: “Introducing Auto-Forwarding Mail Protection for Microsoft 365”.
Key questions
A: The mailbox is only one copy point, so post-delivery remediation can miss messages already replicated into downstream workflows.
Q: Why do forwarded phishing and BEC emails remain risky after the inbox has been cleaned up?
A: Because cleanup in the mailbox does not necessarily remove the copy in the business system where people actually work.
Q: How can security teams tell whether auto-forwarded mail coverage is working?
A: Look for whether forwarded messages are inspected before they are replicated into downstream tools and whether every mail path is visible in a single security workflow.
Practitioner guidance
- Map every auto-forwarding path Inventory which mailboxes, shared inboxes, CRM integrations, and ticketing workflows can replicate email content outside the mailbox before security review is complete.
- Move inspection ahead of forwarding Use pre-delivery inspection for messages that will be forwarded into business systems so malicious content can be stopped before it becomes a downstream work item.
- Separate coverage by mailbox type Treat individual cloud mailboxes, Google Groups Collaborative Inboxes, and hybrid on-premises mailboxes as different control domains because their remediation paths are not equivalent.
Bottom line: Email auto-forwarding turns downstream work systems into part of the attack surface, even when the original inbox is already remediated.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 days ago by NHI Mgmt Group
27/06/2026 3:08 pm
Auto-forwarding creates an email governance gap, not just a delivery convenience. The inbox is no longer the full security boundary when mail is routinely copied into CRMs, ticketing systems, and helpdesks. That changes the control objective from cleaning up after delivery to governing the path the message takes before users ever see it. Practitioners should treat forwarding rules and workflow integrations as part of the identity and access surface around email.
A few things that frame the scale:
- The average time to mitigate a leaked secret is 36 hours, highlighting the operational burden of manual remediation processes, according to the 2024 State of Secrets Management Survey.
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to the State of Secrets in AppSec.
A question worth separating out:
Q: What should organisations do when forwarding rules move email into operational systems?
A: They should treat those systems as part of the email security boundary and not as neutral destinations. That means governing forwarding paths, shared inboxes, and hybrid mailbox types as distinct exposure points. If the business depends on a message being visible downstream, the inspection model has to move upstream to match that reality.
👉 Read our full editorial: Email auto-forwarding exposes a wider attack surface than the inbox
This post was modified 2 days ago by NHI Mgmt Group