Topic starter
27/06/2026 2:02 pm
TL;DR: Cloud email remains a high-value attack channel because phishing, vendor compromise, token abuse, and misconfigurations routinely bypass inbox-centric controls, according to Abnormal AI, while CISA and IBM data show attackers move fast and containment stays slow. Static detection is no longer enough when identity signals, behavioural context, and configuration drift drive exposure.
Editorial analysis by NHI Mgmt Group, based on content published by Abnormal AI: “8 Threats Redefining Cloud Email Security in 2025”.
By the numbers:
- 84% of employees fall for phishing within ten minutes, giving attackers a narrow but highly effective window for success.
- Phishing-related breaches take an average of 254 days to contain, creating a prolonged window of risk.
- The average data breach in the U.S. now costs over $10 million, with phishing and vendor email compromise among the leading causes.
Key questions
Q: How should security teams detect email attacks that look legitimate at first glance?
A: They should combine behavioural intelligence with identity and collaboration telemetry, then look for deviations from normal sender relationships, message timing, forwarding behaviour, and delegated access.
Q: Why do vendor account compromises bypass many email security tools?
A: Vendor account compromise works because the attacker inherits a real sender identity, existing trust relationships, and often a valid conversation thread.
Q: What breaks when cloud email security stops at the inbox?
A: Inbox-only security misses the tenant, identity, and application layers where persistent access often lives.
Practitioner guidance
- Extend email detection beyond content inspection Correlate message analysis with sender identity, prior relationship history, thread context, and behavioural anomalies so legitimate-looking mail is still evaluated for trust drift.
- Tie cloud email alerts to identity telemetry Link sign-in events, session state, browser fingerprints, and app-consent records so a compromised account is not treated as healthy simply because the email looks normal.
- Automate quarantine and removal Remove confirmed malicious messages from all affected inboxes immediately instead of waiting on manual SOC triage, because dwell time is part of the exposure window.
Bottom line: Cloud email security gaps persist because attackers increasingly exploit trusted identities, session tokens, vendor accounts, and tenant misconfigurations rather than obvious malicious content.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
27/06/2026 3:38 pm
Cloud email security is now an identity governance problem, not just a filtering problem: The article shows that legitimacy is the attacker’s main asset, whether it comes from a hijacked vendor account, a stolen session token, or an over-permissive app grant. Static inbox controls cannot govern trust once the message inherits an already-authorised identity. The practitioner implication is that email security must be tied to identity state, app trust, and tenant configuration rather than treated as a separate content layer.
A few things that frame the scale:
- The average time to mitigate a leaked secret is 36 hours, highlighting the operational burden of manual remediation processes, according to the 2024 State of Secrets Management Survey.
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to the State of Secrets in AppSec.
A question worth separating out:
Q: What should teams do immediately after identifying a malicious cloud email campaign?
A: They should remove the message from all impacted inboxes, revoke suspicious sessions or app grants, and inspect related identity and tenant changes for persistence. Containment has to include the account, the message, and the configuration layer, otherwise the same attacker can keep using trusted paths to continue the campaign.
👉 Read our full editorial: Cloud email security gaps are outpacing legacy detection controls