Topic starter
27/06/2026 1:51 pm
TL;DR: Clean-text BEC, vendor fraud, and credential phishing now bypass perimeter filters by abusing identity and behaviour, while Microsoft 365 and Google Workspace already cover many commodity threats, according to Abnormal AI. The result is a governance problem, not just a tooling problem: teams must judge email security on post-delivery detection, identity signals, and operational overlap rather than gateway habit.
Editorial analysis by NHI Mgmt Group, based on content published by Abnormal AI: “Who Does the SEG Serve in a Cloud-First World?”.
Key questions
Q: What breaks when secure email gateways are the main email security control?
A: When SEGs are treated as the main control, organisations often miss identity-based phishing, internal impersonation, and outbound leakage driven by human error.
Q: Why do native cloud email controls reduce the value of third-party gateways?
A: Because Microsoft 365 and Google Workspace already handle spam, known malware, and basic phishing for many organisations.
Q: How should security teams measure whether a secure email gateway is still effective?
A: Measure how often it blocks real threats, how much analyst time it consumes, and how many false positives it creates.
Practitioner guidance
- Map SEG coverage against native cloud controls Inventory what Microsoft 365 and Google Workspace already block in your environment, then isolate which remaining threats the third-party gateway uniquely stops.
- Validate behavioural detection before retiring the gateway Run modern email security in parallel with the existing SEG and compare detections on BEC, vendor impersonation, and credential phishing cases that pass authentication checks.
- Reduce allowlisting and false-positive churn Measure how much analyst time is spent maintaining gateway policy, allowlists, and quarantine triage versus investigating real identity-abuse events.
Bottom line: Third-party secure email gateways struggle when attacks arrive as legitimate, clean-text messages that rely on identity abuse instead of payload delivery.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
27/06/2026 3:20 pm
Third-party SEG value is collapsing because the control is tied to a false premise: that email risk is best judged at arrival. That premise held when malware attachments and signature matching dominated the threat model, but it fails when the abuse path is identity, trust, and conversation rather than payload. The implication is that email security governance must be evaluated on how well it understands live identity signals, not on how much mail it quarantines.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should organisations replace perimeter email filtering with post-delivery detection?
A: They should if their dominant email risk comes from clean-text attacks that unfold through identity and behaviour rather than payloads. Post-delivery detection is better suited to cloud email because it can use user context, sender history, and message sequence to find abuse after the inbox.
👉 Read our full editorial: Why third-party secure email gateways are losing value
This post was modified 4 days ago by NHI Mgmt Group