Notifications
Clear all
Topic starter
27/06/2026 1:58 pm
TL;DR: Legacy secure email gateways miss payload-less, socially engineered attacks that bypass static rules, while one real-world text-only email led to a $753,000 loss and Abnormal AI says replacing third-party SEGs can cut licensing costs by 42% and SOC time by 95%. The governance issue is no longer spam filtering, but whether identity-aware email controls can detect behavioural anomalies before trust is exploited.
NHIMG editorial — based on content published by Abnormal AI: Key Insights on why SEGs miss payload-less, socially engineered attacks
By the numbers:
- Replacing third-party SEGs saves organisations an average of 42% in licensing costs and cuts SOC time by 95%.
- 76% of Abnormal's 550-plus enterprise customers now operate without a third-party SEG after migration.
Questions worth separating out
Q: How should security teams stop text-only email fraud when there is no malware to block?
A: Security teams need controls that evaluate sender behaviour, conversation history, and business context, not just message payloads.
Q: Why do secure email gateways fail against modern phishing and invoice fraud?
A: SEGs fail because they were designed around malicious links, attachments, and known-bad indicators.
Q: How do teams know whether a second email security layer is actually adding value?
A: A second layer adds value only if it detects a different class of risk from the native mailbox security stack.
Practitioner guidance
- Map high-trust mail flows first Identify the conversations that can trigger money movement, credential reset, or privileged approval, then assign tighter verification rules to those paths.
- Test controls against payload-less attacks Run monitor-only simulations using text-only vendor impersonation, invoice-change fraud, and reply-thread abuse so you can see what passes static filters.
- Measure unique detection value per email layer Inventory which threats each layer actually stops, then remove or reconfigure controls that only duplicate spam and malware handling.
What's in the full article
Abnormal AI's full analysis covers the operational detail this post intentionally leaves for the source:
- Specific migration steps for moving from a third-party SEG to cloud-native email protection without disrupting mail flow
- The monitor-only proof-of-value approach used to compare SEG coverage against behavioural detection in live environments
- Operational detail on how Abnormal's migration specialists evaluate policies and handle cut-over planning
- Examples of the workflows and false positives that drive analyst time in SEG-heavy environments
👉 Read Abnormal AI's analysis of why legacy SEGs miss payload-less email attacks →
Payload-less email attacks: what IAM and SOC teams are missing?
Explore further
27/06/2026 3:31 pm
Payload-less email fraud is a trust-control failure, not a spam problem: The attack works because the control stack still assumes malicious email must contain detectable payloads or obvious indicators. That assumption fails when the actor uses a believable conversation thread and the business process itself becomes the target. Practitioners should treat this as a shift from mail hygiene to identity-aware trust governance.
A few things that frame the scale:
- Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems, according to The 2026 Infrastructure Identity Survey.
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security.
A question worth separating out:
Q: Who should verify payment changes when a trusted email request looks legitimate?
A: The request should be verified by a separate control owner or process, not by replying within the same email thread. Finance, procurement, and executive teams should use out-of-band verification for bank-detail changes, urgent transfers, and supplier updates. That breaks the attacker’s ability to convert trust into immediate action.
👉 Read our full editorial: AI-driven email fraud is exposing gaps in legacy SEG controls
