Notifications
Clear all
Topic starter
27/06/2026 1:58 pm
TL;DR: Email accounted for 68% of malware attacks in 2024, and IBM pegs average ransomware cost at $5.8 million per incident, showing how inbox compromise still drives enterprise disruption even as AI-generated variants and in-memory payloads evade static defenses. Signature-based controls are no longer enough when attackers weaponize trust, timing, and lateral movement across connected tools.
NHIMG editorial — based on content published by Abnormal AI: email-borne malware, ransomware, and behavioural AI detection
By the numbers:
- 68% of all malware attacks in 2024 originated via email.
- 35% of companies hit by ransomware report lasting customer trust loss.
Questions worth separating out
Q: How should security teams handle a compromised mailbox in an identity programme?
A: Treat it as an identity and access event, not only a mail hygiene issue.
Q: Why do email-borne attacks still work against modern security controls?
A: They work because many controls still depend on static indicators such as links, files, and repeated payload patterns.
Q: What breaks when teams rely on secure email gateways alone?
A: Teams miss in-memory malware, delayed redirects, and trusted conversation hijacking that never looks malicious at delivery time.
Practitioner guidance
- Reclassify mailbox compromise as an identity incident When a user mailbox is compromised, treat it as a trigger for access containment across collaboration suites, shared drives, and connected business apps.
- Reduce downstream privilege reachable from email identities Audit which email-linked accounts can approve payments, reset credentials, invite external users, or trigger privileged workflows.
- Prioritise behavioural controls over static indicators Use detection that scores sender reputation, message timing, conversation context, and post-delivery actions rather than relying mainly on known hashes or suspicious links.
What's in the full article
Abnormal AI's full article covers the operational detail this post intentionally leaves for the source:
- The article's breakdown of how AI-driven malware changes message crafting, timing, and evasion patterns in practice.
- The vendor's explanation of why legacy secure email gateways and sandboxes miss fileless or delayed threats.
- The full discussion of behavioural AI detection and how it models normal communication patterns.
- The source article's closing guidance on turning inbox visibility into measurable resilience.
👉 Read Abnormal AI's analysis of email-borne malware, ransomware, and behavioural AI →
Email malware and ransomware: why legacy controls are failing?
Explore further
27/06/2026 3:31 pm
Email security is now an identity governance problem, not just a content filtering problem. The article shows that attackers do not need to beat every technical control when they can exploit the trust chain around mailbox access, approvals, and follow-on collaboration. That means the security boundary is the identity and the workflow attached to it, not the message alone. Practitioners should treat mailbox compromise as a governance event that can trigger downstream access review and containment.
A few things that frame the scale:
- From our research: Two-thirds of enterprises have endured a successful cyberattack resulting from compromised non-human identities, with a quarter encountering multiple attacks, according to The 2024 ESG Report: Managing Non-Human Identities.
- Our research also finds that enterprises that have experienced a compromised NHI averaged 2.7 separate incidents in the past 12 months.
A question worth separating out:
Q: Who is accountable when a phishing email turns into ransomware?
A: Accountability usually spans email security, identity governance, and incident response because the attack crosses those boundaries quickly. The security team must show how the mailbox was protected, how access was contained, and how downstream privileges were reviewed once the account was compromised.
👉 Read our full editorial: Email-borne malware still drives most attacks and ransomware loss
