Topic starter
27/06/2026 1:35 pm
TL;DR: Many organisations pairing Microsoft 365 with a legacy secure email gateway are duplicating baseline protections while still missing advanced attacks, with Abnormal customers seeing 462 advanced attacks per month bypass Microsoft native controls per 1,000 mailboxes and AI-driven phishing now four times more effective than traditional campaigns, according to Abnormal AI and Microsoft. The real governance gap is not more inspection, but different detection logic for identity-based and text-only threats.
Editorial analysis by NHI Mgmt Group, based on content published by Abnormal AI: “Real Defense in Depth Starts with Abnormal + Microsoft”.
By the numbers:
- Abnormal customers see an average of 462 advanced attacks per month bypassing Microsoft native controls per 1,000 mailboxes.
- 76% of Abnormal customers now run without a third-party SEG.
- 800+ organisations have migrated over 3.5 million mailboxes to the native+AI model.
Key questions
Q: Where do legacy SEGs fail when Microsoft 365 already handles baseline email protection?
A: They fail when the threat is clean, contextual, and identity-driven rather than malware-driven.
Q: Why do duplicated email controls not always improve defence in depth?
A: Because defence in depth depends on independent coverage, not two tools inspecting the same signals.
Q: How can security teams tell whether their SEG is still adding value in Microsoft 365?
A: Check whether it catches threat classes that Microsoft’s native controls do not already cover, especially behavioural attacks that have no malicious payload.
Practitioner guidance
- Map detection logic by threat class Separate baseline hygiene controls for spam, malware, and known payloads from behaviour-based detections for BEC, vendor fraud, and account takeover.
- Review SEG dependence on Microsoft 365 routing Check whether the legacy SEG forces mail flow around native Microsoft protections or disables parts of the Microsoft stack.
- Measure false-positive and triage burden Compare manual review volume, alert quality, and response time before and after SEG overlap.
Bottom line: Legacy SEG overlap in Microsoft 365 often creates duplicated baseline controls rather than independent defence in depth.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
27/06/2026 2:58 pm
Legacy SEG overlap is a control architecture problem, not an email volume problem. The article describes a common failure mode where organisations keep two tools that are both optimised for known threats and then assume they have created stronger defence in depth. In practice, that produces redundancy around baseline filtering while leaving the highest-value attacks under-covered. The implication for practitioners is that overlap must be judged by detection logic, not by the number of products in the stack.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What should organisations do when email attacks are becoming more identity-based?
A: Move some of the detection burden from static message inspection to behavioural analysis across senders, recipients, vendors, and workflows. That makes it easier to identify abuse that looks technically clean but is operationally suspicious.
👉 Read our full editorial: Microsoft 365 and legacy SEG overlap leaves advanced email gaps