A gateway can reduce volume, but it does not eliminate every malicious message, especially when attackers use social engineering, lookalike infrastructure, or low and slow delivery patterns. When those threats bypass the first layer, they still reach users and can lead to credential theft, mailbox compromise, and broader business disruption. Defense in depth exists to catch those residual failures.
Why the gateway helps, but cannot close the problem
A secure email gateway is a filtering layer, not a guarantee. It can block a large share of obvious phishing, but attackers adapt with lookalike domains, newly registered infrastructure, compromised legitimate senders, and slow delivery patterns that reduce detection confidence. The residual risk is the point: any message that reaches a user can still trigger credential theft or session abuse.
That is why account takeover remains a live issue even with good perimeter filtering. Once credentials are harvested, the attacker no longer needs to keep sending suspicious email from the same path. They can authenticate directly, impersonate the user, and pivot into mailbox rules, internal messaging, shared files, or downstream approvals.
For a broader view of how these residual failures turn into real compromise, the pattern is consistent across breach reporting and credential abuse cases, including 52 NHI Breaches Analysis, which shows how stolen secrets and compromised access often become the actual entry point after the first control layer fails.
In practice, phishing controls lower exposure but do not remove the need for phishing-resistant authentication, strong mailbox controls, and post-delivery detection. The gateway is only one control in the chain.
How attackers still get through and turn one click into compromise
Credential phishing succeeds when the attacker can create enough trust to make the user supply a password, MFA code, token, or session approval. Secure gateways struggle most with messages that are socially engineered rather than obviously malicious, or with campaigns that use legitimate cloud services, short-lived infrastructure, or compromised business accounts to blend in.
Once a user interacts, the incident is no longer just an email problem. It becomes an authentication and access problem. Stolen credentials can unlock SSO sessions, mailbox access, forwarding rules, password reset flows, and later-stage impersonation. That is why the impact often outlives the original phish.
The compromise path is especially clear in GitLocker GitHub extortion campaign and MailChimp Breach, where social engineering and stolen credentials enabled access that then exposed much broader business data.
Even where the initial message is filtered, users still face residual exposure from internal forwarding, thread hijacking, reply-chain abuse, and follow-on messages that arrive after the gateway decision. That is why defenders should treat email security as a layered detection and response problem, not only a message-blocking problem.
What practitioners should verify after deployment
What to verify: confirm whether the gateway is reducing volume, not just claiming success. Teams should measure what proportion of malicious mail is being caught pre-delivery, what proportion reaches inboxes, and how quickly users report the rest. If mailbox compromise or suspicious sign-in events continue, the control is incomplete even if spam counts look good.
Decision rule: if the threat includes credential theft, account takeover, or internal impersonation, add phishing-resistant authentication, conditional access, mailbox rule monitoring, and user-reporting workflows before assuming the email layer is sufficient. A strong email filter reduces noise; it does not replace account protection.
What to prioritize: start with the highest-value accounts, especially mailboxes that can reset passwords, approve payments, manage vendors, or access sensitive systems. Those accounts create the most damaging blast radius when phishing succeeds.
NHIMG’s Ultimate Guide to NHIs is useful here because the same compromise pattern often extends beyond human users into service credentials and tokens once attackers gain a foothold. The underlying control lesson is that access material must be visible, rotated, and bounded if email compromise is to stay contained.
Practitioner takeaway: the right test is not whether the gateway blocks most phishing, but whether the rest of the environment can absorb the messages that still get through without turning one successful lure into a full account takeover.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | 5 — Account Management | Email phishing becomes account takeover when account controls fail or are weak. |
| 6 — Access Control Management | Stopping post-phish abuse depends on least privilege and restricted access paths. | |
| 8 — Audit Log Management | Mailbox takeover is often visible first in login, rule, and forwarding activity. | |
| Recommendation — Tighten account lifecycle controls and remove stale or overexposed accounts. Enforce least privilege and restrict privileged actions exposed to compromised mailboxes. Collect and review authentication and mailbox-rule logs for takeover indicators. | ||
| NIST CSF 2.0 | PR.AA — Identity Management, Authentication, and Access Control | Phishing risk persists when authentication and access controls can be bypassed or abused. |
| DE.CM — Continuous Monitoring | Residual phishing risk requires monitoring for suspicious sign-ins and mailbox abuse. | |
| RS.AN — Analysis | Account takeover needs rapid triage of malicious sign-ins and user-reported phish. | |
| Recommendation — Use strong authentication and access controls that resist credential theft. Monitor for anomalous authentication, forwarding, and inbox rule changes. Analyze suspicious mail and login telemetry quickly to confirm compromise scope. | ||
| OWASP Non-Human Identity Top 10 | NHI-01 — Secret Sprawl | Phishing often escalates into stolen tokens, keys, or other exposed secret material. |
| NHI-03 — Overprivilege | A phished account becomes more damaging when its permissions exceed business need. | |
| NHI-07 — Identity Lifecycle and Rotation | Residual compromise often persists because credentials and sessions are not rotated fast enough. | |
| Recommendation — Reduce exposed secret surfaces so one phish cannot unlock multiple systems. Limit permissions so stolen credentials have minimal blast radius. Rotate exposed credentials and invalidate sessions promptly after suspected phishing. | ||
| MITRE ATT&CK | T1566 — Phishing | The question is about why phishing still succeeds despite perimeter filtering. |
| Recommendation — Map phishing variants and detections to the delivery and execution techniques used. | ||
Related resources from NHI Mgmt Group
- Why do phishing attacks remain effective even with secure email gateways?
- Why do account takeover incidents remain difficult to close even after access is revoked?
- Why do account takeover and phishing risks remain high in school email environments?
- Why do call centers remain a common account takeover path even when MFA is in place?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
