Why do legacy gateways struggle with modern phishing and BEC attacks?

Why This Matters for Security Teams

Legacy gateways were built to stop obvious spam, known malicious domains, and repeated patterns. Modern phishing and BEC campaigns no longer depend on those stable signals. AI-assisted attackers can generate clean prose, mimic tone, localise language, and vary delivery infrastructure fast enough to outrun rule updates. That shifts the defender’s problem from content filtering to identity, behaviour, and transaction context. Guidance from the CISA cyber threat advisories and the Ultimate Guide to NHIs both point to the same operational reality: attackers now exploit trust chains, not just inbox filters. NHI Mgmt Group research also shows that 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, which matters because email compromise often becomes an access compromise next. In practice, many security teams encounter the damage only after an approved payment, a reset credential, or a mailbox rule has already been created, rather than through intentional detection of the initial lure.

How It Works in Practice

Modern gateways struggle because their decisioning is too static for how these attacks now behave. A message can be benign at delivery time, then become dangerous after the attacker changes a linked page, swaps infrastructure, or uses a compromised account to reply inside an existing thread. For BEC, the risk is not just whether a message looks suspicious. It is whether the request matches business context, identity history, and payment workflow.

Current detection works better when gateways feed into a broader control stack:

• Authenticate the sender path with SPF, DKIM, and DMARC, but do not assume authentication equals legitimacy.
• Correlate mailbox activity, impossible travel, forwarding rules, and reply-chain anomalies.
• Use identity signals from privileged access and NHI systems to see whether an account or token is being used in an unusual sequence.
• Apply behavioural analysis at the message and user level, especially when the request includes urgency, secrecy, or financial redirection.
• Check the transaction itself, such as payee changes, payroll shifts, or vendor bank detail updates, before approval.

This is consistent with the threat pattern described in The 52 NHI breaches Report and in Anthropic’s report on AI-orchestrated cyber espionage, where automation increases attacker speed and adaptability. Legacy gateways also miss multi-stage attacks that begin with a harmless message and end in a credential reset, invoice diversion, or inbox takeover. These controls tend to break down in high-volume shared inbox environments because context is distributed across people, systems, and workflows, making a single gateway verdict too shallow.

Common Variations and Edge Cases

Tighter filtering often increases false positives and user friction, so organisations have to balance blocking suspicious mail against disrupting legitimate business communication. That tradeoff becomes sharper in environments where external vendors, multilingual correspondence, or executive assistants handle high-trust workflows.

There is no universal standard for this yet, but current guidance suggests that BEC defence should be tuned differently from commodity phishing defence. For example, invoice fraud often requires payment verification steps, while credential theft demands rapid session revocation and identity monitoring. Some organisations still rely on mail gateway quarantine as the final control, but that breaks down when the attacker uses a trusted vendor account, a compromised internal mailbox, or a conversation that has been dormant for weeks.

Practical teams now combine gateway signals with out-of-band approval, risk-based step-up authentication, and anomaly detection across identity and finance systems. The main lesson from Ultimate Guide to NHIs — Why NHI Security Matters Now is that trust is increasingly computed from connected systems, not inferred from a single message. Legacy gateways struggle most when the attacker can borrow credibility from a real account, a real thread, or a real business process, because the message itself is no longer the primary signal.

Related resources from NHI Mgmt Group

• Why do vendor fraud and impersonation attacks bypass legacy email defenses?
• Why do legacy tools keep missing modern attack patterns?
• How can organizations counter AI-driven cyber attacks?
• Why do AI-driven phishing attacks still succeed when organisations use modern authentication?