Topic starter
27/06/2026 1:59 pm
TL;DR: Phishing now accounts for 77% of advanced email attacks, while business email compromise caused more than $2.7 billion in losses last year and account takeovers averaged $4.67 million per breach, according to Abnormal AI. Traditional secure email gateways are losing their edge because modern attacks are contextual, credential-led, and increasingly tied to third-party app abuse.
Editorial analysis by NHI Mgmt Group, based on content published by Abnormal AI: “Top 8 Alarming Anomalies That Are Evading Your SEG”.
By the numbers:
- Phishing now accounts for 77% of all advanced email attacks.
- Account takeovers average $4.67 million per breach.
- Exploited third-party apps connected to email environments contribute to 30% of data breaches.
Key questions
Q: What breaks when secure email gateways are the main email security control?
A: When SEGs are treated as the main control, organisations often miss identity-based phishing, internal impersonation, and outbound leakage driven by human error.
Q: Why do compromised mailboxes create so much downstream risk?
A: Compromised mailboxes are dangerous because they already sit inside trusted workflows.
Q: What do security teams get wrong about removing third-party app access from user accounts?
A: A common mistake is treating the account’s app list as the only source of truth.
Practitioner guidance
- Map inbox trust paths Inventory which mailboxes have delegated authority into file stores, collaboration tools, finance workflows, and external apps, then rank them by business impact and compromise potential.
- Review connected app consent Audit third-party applications with email or data permissions, remove unused integrations, and require explicit re-approval for high-risk scopes.
- Contain mailbox takeover fast When a mailbox is compromised, revoke sessions, disable suspicious forwarding rules, reset credentials, and inspect downstream applications that trust the account.
Bottom line: AI-assisted phishing, BEC, and QR-code lures reduce the value of traditional SEG indicators because the attack lives in context and identity trust.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
27/06/2026 3:32 pm
Identity-aware email defence is now a governance issue, not just a filtering issue. The article shows that modern email attacks succeed because the deciding factor is trust, not syntax. When message content is no longer a reliable signal, programmes that stop at SEG inspection are governing the wrong control point. The practitioner conclusion is that email security has to be evaluated as part of identity trust governance.
A question worth separating out:
Q: What should organisations do when AI-driven social engineering targets high-access users?
A: Prioritise containment before the user can complete a risky action. Escalate verification, restrict account changes, and alert identity and security teams when a privileged user is receiving unusual AI-generated requests. The response should focus on interruption, confirmation, and reducing the chance of irreversible approval.
👉 Read our full editorial: AI-native email threats expose the limits of SEG-based identity controls