Notifications
Clear all
Topic starter
27/06/2026 2:02 pm
TL;DR: Cloud email remains a primary attack channel because phishing, vendor compromise, token abuse, and misconfigurations routinely bypass inbox-centric defenses, while CISA and IBM data show attackers move fast and containment stays slow. Legacy controls built for static indicators are no longer enough when identity, behavioural context, and configuration drift drive exposure.
NHIMG editorial — based on content published by Abnormal AI: cloud email security gaps and the capabilities needed to address them
By the numbers:
- 84% of employees fall for phishing emails within ten minutes, giving attackers a narrow but highly effective window for success.
- Phishing-related breaches take an average of 254 days to contain, creating a prolonged window of risk.
- The average data breach in the U.S. now costs over $10 million, with phishing and vendor email compromise among the leading causes.
Questions worth separating out
Q: How should security teams reduce the risk of cloud email phishing in modern environments?
A: Security teams should combine message inspection with identity and relationship context.
Q: Why do vendor account compromises bypass many email security tools?
A: Vendor account compromise works because the attacker inherits a real sender identity, existing trust relationships, and often a valid conversation thread.
Q: What breaks when cloud email security stops at the inbox?
A: Inbox-only security misses the tenant, identity, and application layers where persistent access often lives.
Practitioner guidance
- Correlate identity signals with message inspection Combine sender history, login patterns, device context, and app behaviour before deciding whether a message is trustworthy.
- Baseline each vendor relationship separately Track normal cadence, recipient patterns, thread behaviour, and payment or request flows for important external partners.
- Review tenant permissions and connected apps as part of security operations Audit Microsoft 365 or Google Workspace settings for excessive permissions, stale OAuth grants, and administrative drift.
What's in the full article
Abnormal AI's full analysis covers the operational detail this post intentionally leaves for the source:
- Behavioural detection logic for vendor compromise, internal phishing, and account takeover patterns.
- Tenant configuration checks for Microsoft 365 and Google Workspace, including permission drift and app integrations.
- Operational response workflows for automatically removing confirmed malicious mail from affected inboxes.
- Practical evaluation criteria for deciding when cloud email security needs identity-aware controls instead of static filtering.
👉 Read Abnormal AI's analysis of cloud email security gaps and identity-led threats →
Cloud email security gaps: what IAM teams need to know now?
Explore further
27/06/2026 3:38 pm
Cloud email security is now an identity governance problem, not just a content filtering problem. The article’s core pattern is not that bad messages exist, but that attackers repeatedly exploit identity context, tenant permissions, and trust relationships. That changes the control question from blocking messages to governing who or what can speak with legitimacy inside business communication channels. Practitioners should treat mail, identity, and application permissions as one attack surface.
A few things that frame the scale:
- Organisations maintain an average of 6 distinct secrets manager instances, creating fragmentation that undermines centralised control, according to The State of Secrets in AppSec.
- 43% of security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases.
A question worth separating out:
A: Accountability should sit with the team that owns identity governance across the account, tenant, and connected application layer, not only with the SOC. If access, app grants, and administrative changes are not lifecycle-managed, the security failure is structural. The right response is shared ownership across IAM, email security, and platform operations.
👉 Read our full editorial: Cloud email security gaps are outpacing legacy detection controls
