Why do email-borne attacks still work against modern security controls?

Why This Matters for Security Teams

Email-borne attacks still succeed because email remains a trusted business workflow, not just a transport channel. Modern filters can reduce obvious malware and known phishing kits, but they do not fully solve impersonation, delayed payloads, reply-chain abuse, or payloads that change after delivery. The control gap is especially visible when identity context is weak and message risk is judged only by links or attachments. That is why guidance around identity-aware defence keeps rising in importance in both The State of Non-Human Identity Security and the broader lessons captured in 52 NHI Breaches Analysis. Modern attackers also benefit from a compressed response window, as shown in LLMjacking: How Attackers Hijack AI Using Compromised NHIs, where exposed AWS credentials were targeted within minutes.

For defenders, the practical issue is not whether the message looks suspicious in isolation, but whether it fits a legitimate sender relationship, business process, and access pattern. Controls that ignore that context miss the real attack surface. In practice, many security teams encounter successful email abuse only after a trusted account, vendor thread, or workflow has already been leveraged to make the message look normal.

How It Works in Practice

Effective defence against email-borne attacks requires moving from content inspection alone to layered detection across identity, delivery, and action. Static indicators still matter, but they are no longer sufficient because attackers routinely alter wording, rotate infrastructure, and delay malicious action until after the initial scan window. Current guidance suggests treating the message as one signal among several, then combining it with sender identity, tenant history, authentication results, and the downstream behaviour of the recipient.

Practitioners usually improve resilience by aligning email security with identity controls and workflow controls:

• Use phishing-resistant authentication and enforce strong sender verification so impersonation is harder to sustain.
• Correlate message events with account behaviour, such as impossible travel, unusual forwarding, or new mailbox rules.
• Score attachments, links, and reply-chain anomalies together rather than relying on any single indicator.
• Apply least privilege to mailboxes, service accounts, and automation so a compromised inbox does not become a broad access path.
• Feed detections into response playbooks that can suspend sessions, revoke tokens, and isolate affected accounts quickly.

This is consistent with the behaviour-focused direction seen in Top 10 NHI Issues, where credential misuse and monitoring gaps repeatedly amplify downstream compromise. It also aligns with external threat reporting from Anthropic — first AI-orchestrated cyber espionage campaign report and the CISA cyber threat advisories, both of which reinforce the need to detect attacker activity after delivery, not just at the inbox boundary.

These controls tend to break down in large Microsoft 365 or Google Workspace environments where permissive mail rules, third-party integrations, and delegated access create too many legitimate-looking paths for abuse.

Common Variations and Edge Cases

Tighter email controls often increase user friction and help-desk load, so organisations must balance blocking risk against business continuity. The tradeoff is real: aggressive filtering can disrupt partner communications, while permissive settings leave room for credential theft, account takeover, and business email compromise. Best practice is evolving, and there is no universal standard for exactly how much friction is acceptable.

Edge cases are where static controls fail most obviously. Reply-chain hijacking may pass every content check because the thread is genuine. QR-code phishing can bypass simple URL inspection. Malware-free attacks can rely on social engineering plus a second-stage login page, so the message itself contains nothing obviously malicious. OAuth abuse and mailbox delegation are also common because the attacker never needs a traditional attachment or link after initial access.

That is why the strongest programmes combine email security with identity governance and threat-informed monitoring, as highlighted in Ultimate Guide to NHIs — Why NHI Security Matters Now and Ultimate Guide to NHIs — Key Challenges and Risks. When identity context is missing, even a clean-looking message can become the first step in a broader compromise. In high-trust internal mail environments, these attacks become most effective because users and controls both assume the sender is already validated.

Related resources from NHI Mgmt Group

• How should security teams evaluate identity controls against AI-driven attacks?
• Why do rules-based email controls fail against modern phishing and vendor impersonation?
• What breaks when email security relies on static rules against AI-driven attacks?
• Why do shortcut-file attacks still bypass mature email controls?