When should organisations prioritise mailbox containment over mail filtering during BEC?

When mailbox containment should come first in BEC

mailbox containment should take priority when the event is no longer just a suspicious message and looks like an active account compromise. If the attacker can sign in, create rules, or keep a session alive, filtering alone will not stop the abuse. The immediate problem is preserving control of the mailbox and cutting off the attacker’s ability to act.

That change in posture matters because BEC often moves from delivery abuse to mailbox abuse. Once an account is real and active, the malicious value comes from persistence, message access, forwarding, and rule-based concealment, not only from the original phishing or spoofed email.

How to tell filtering is not enough

Filtering is the right first line for spoofed or unauthenticated mail, especially when the message never touched a legitimate user account. But when sign-in logs show unusual geography, impossible travel, unfamiliar user agents, repeated consent events, or mailbox rule changes, the event should be treated as an identity problem as much as a mail problem.

At that point, the useful question is not “Can we block this message?” but “Has the mailbox been used as an attacker foothold?” If the answer is yes, the containment action has to interrupt session access, remove hostile rules, and prevent continued use of the account for follow-on fraud or internal impersonation.

Why containment changes the incident outcome

Mailbox compromise turns BEC into an access-control and persistence issue. The attacker can read replies, intercept invoices, reset other accounts through email workflows, and wait for a better opportunity than the initial lure. Email Identity and BEC Guide is useful here because it ties mail authentication, mailbox takeover, OAuth permissions, and payment verification into one response model.

Containment also matters because the attacker’s ability to stay in the mailbox is what extends blast radius. Even a single compromised mailbox can expose internal thread context, contact lists, payment timing, and security reset paths. The longer the session survives, the more likely the attacker can blend in and move from message deception to business process abuse.

Risk and Threat Considerations

Mailbox filtering reduces delivery of bad mail, but it does not remove an attacker who already has a valid session, a stale token, or a malicious inbox rule. In BEC, that gap creates ongoing exposure because the attacker can continue reading, replying, and redirecting messages while appearing to be a legitimate user.

Failure mechanism: The compromise survives the message layer and lives in the account layer, so simple spam filtering or sender blocking leaves the attacker’s access path intact.

Impact: The attacker can preserve persistence, conceal replies, and keep abusing the mailbox for fraud, impersonation, and internal trust exploitation until the account is truly contained.

Practitioner Guidance

What to verify: Confirm whether the suspicious email is tied to a live account before choosing a response path. If you see mailbox rule creation, delegated access, refresh-token use, or sign-in activity after the lure arrived, treat the mailbox as compromised rather than merely exposed.

Decision rule: If the mailbox can still authenticate, prioritise session revocation, rule removal, and credential reset before spending time on additional filtering changes. If no account compromise is evident, filtering and quarantine may be sufficient for the specific message.

What good looks like: The user cannot continue to access the mailbox, hostile forwarding and inbox rules are removed, and any reused credentials or tokens are rotated quickly enough that the attacker loses both visibility and persistence.

Practitioner takeaway: In BEC, delivery control is useful, but active mailbox control is decisive once the attacker has a real session or account foothold.

Related resources from NHI Mgmt Group

• When should organisations prioritise inbox precision over traditional mailbox filtering?
• When should organisations prioritise containment authority over deeper alert enrichment?
• When should organisations prioritise JWT group filtering over sending full group membership claims?
• Should organisations prioritise runtime monitoring over stricter API request filtering?