Topic starter
24/06/2026 11:08 pm
TL;DR: Secure email gateways still matter because they stop phishing, malware, and spoofing before delivery, but identity-based attacks increasingly bypass mailbox perimeter controls once an account is compromised, according to SecurEnds. The real security problem is not email filtering alone, but whether IAM and lifecycle governance can prevent trusted identities from being abused inside cloud email platforms.
Editorial analysis by NHI Mgmt Group, based on content published by SecurEnds: “Secure Email Gateway: What It Is, How It Works, and Why Enterprises Need It”.
Key questions
Q: What breaks when organisations rely only on legacy secure email gateways?
A: They miss attacks that do not depend on obvious malware or malicious links, such as BEC, spoofing and contextual manipulation.
Q: Why do compromised email accounts still create business email compromise risk?
A: Because once an attacker controls a valid mailbox, the messages often look legitimate to users and to some security tools.
Q: How should security teams govern mailbox access in cloud email platforms?
A: Use lifecycle governance for every mailbox, shared mailbox, and delegated access path.
Practitioner guidance
- Align email controls with identity lifecycle Map every mailbox, shared mailbox, and delegated access path to joiner-mover-leaver processes so stale identities are removed when roles change.
- Review overprivileged mailbox access Recertify who can send as, send on behalf of, or access sensitive mailboxes, and remove dormant entitlements that outlive the user’s role.
- Add post-authentication detection Complement gateway filtering with alerts for unusual sending patterns, impossible travel, delegated mailbox abuse, and account takeover indicators inside Microsoft 365 or Google Workspace.
Bottom line: Secure email gateways reduce phishing exposure, but they do not solve the identity abuse that follows a mailbox compromise.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 7:53 am
Email security is an identity governance problem once attackers get inside the tenant. Secure email gateways can reduce inbound phishing risk, but they cannot invalidate a compromised mailbox or revoke a trusted sender relationship already in use. That means the organisation’s real control boundary is the identity lifecycle, not the gateway queue. The practitioner conclusion is straightforward: mailbox abuse must be governed as an IAM and IGA failure, not only as a content-filtering event.
A question worth separating out:
Q: What signs show that email identity controls are not keeping pace?
A: Watch for stale shared mailboxes, persistent delegated send permissions, accounts that remain active after role change, and alerts that show unusual sending behaviour from trusted identities. Those signals usually mean the organisation is protecting the inbox but not the identity behind it.
👉 Read our full editorial: Secure email gateways are not enough for identity-based attacks