What breaks when organisations rely only on legacy secure email gateways?

Why This Matters for Security Teams

Legacy secure email gateway were built for a threat model centred on blocked attachments, flagged URLs and signature-based filtering. That still matters, but it is no longer sufficient when attackers increasingly use mailbox-native abuse, impersonation, vendor fraud and conversation hijacking. Security teams that treat the gateway as the primary control often underestimate how much risk arrives after delivery, inside trusted threads, or through social engineering that looks legitimate to the user.

This is a control design problem as much as a detection problem. Guidance such as NIST SP 800-53 Rev 5 Security and Privacy Controls makes clear that email protection should be part of a broader set of administrative, technical and monitoring controls, not a single perimeter dependency. Once an organisation assumes the gateway has “handled email security,” it often weakens identity verification, internal warning signals and response workflows that matter more for business email compromise than malware.

In practice, many security teams encounter the real failure only after a fraudulent payment request, inbox takeover or trusted-thread abuse has already occurred, rather than through intentional testing of post-delivery controls.

How It Works in Practice

Legacy gateways inspect messages as they pass through the perimeter, looking for indicators such as malicious links, file attachments, spoofed domains and known phishing signatures. That model works best when the attack is obvious before delivery. It breaks down when the adversary uses compromised accounts, low-volume social engineering or infrastructure that appears clean at send time. Many modern campaigns are designed to survive perimeter filtering and succeed later through human trust, not technical payloads.

Effective defence requires layering gateway controls with identity, mailbox and user-verification controls. That means monitoring for impossible travel, new forwarding rules, suspicious consent grants, first-seen senders, display-name impersonation and thread hijacking. It also means aligning detection to the behaviour of the message, not only its content. NIST guidance on security monitoring and access control supports this broader view, and the same logic appears in CISA guidance on recognising and avoiding email scams, which emphasises that social engineering often bypasses purely technical filters.

• Use the gateway for known-bad filtering, URL detonation and attachment controls.
• Monitor mailbox rules, OAuth consent, forwarding behaviour and anomalous send patterns.
• Add identity verification for high-risk requests such as payment changes or credential resets.
• Correlate email alerts with SIEM, SOAR and identity telemetry to detect account abuse.
• Train users to verify context, not just sender address or visual branding.

For broader attack pattern mapping, MITRE ATT&CK is useful because it captures credential access, valid accounts and phishing-related techniques that live beyond the email perimeter. These controls tend to break down when the organisation has fragmented identity ownership across multiple mail tenants and outsourced business processes because no single team sees the full abuse chain.

Common Variations and Edge Cases

Tighter gateway policy often increases operational friction, requiring organisations to balance stronger filtering against false positives, delayed delivery and help desk burden. That tradeoff becomes more pronounced in environments with large partner ecosystems, executive assistants, shared inboxes or high-volume transactional mail, where blocking too aggressively can interrupt legitimate business.

Current guidance suggests there is no universal standard for whether the gateway should also carry anti-phishing simulation, brand impersonation detection or mailbox-level response actions. In practice, the right model depends on whether the dominant risk is commodity spam, targeted fraud or compromise of trusted accounts. For regulated sectors, the control expectation is moving toward layered resilience rather than single-point perimeter defence, which aligns with the monitoring and incident response emphasis in CISA advisories on phishing and BEC tradecraft.

The biggest edge case is when the attacker uses a legitimate, already-authenticated account or manipulates a live conversation. In that scenario, the message may pass every gateway check while still being malicious. That is why legacy SEG-only strategies fail most sharply in Microsoft 365 and Google Workspace deployments where identity, mailbox rules and user behaviour carry more signal than the email body itself.

Related resources from NHI Mgmt Group

• Should organisations replace legacy secure email gateways immediately?
• What breaks when organisations rely on legacy DLP for AI workflows?
• What breaks when organisations rely on standing privilege for support and legacy access?
• What breaks when organisations rely on SMS or email MFA for sensitive access?