Mailboxes are storage locations for email messages on a mail server or email platform. They hold a user's received mail, folders, rules and sometimes shared access permissions. Administrators usually manage mailbox provisioning, delegation, retention and access controls, which affects who can read, send or archive messages.
Mailbox architecture and email storage
Mailboxes are the server-side containers that hold a user’s email, along with the structure and settings that make the mailbox usable over time. In practice, a mailbox is more than a message store: it also reflects how mail is organised, retained, searched and governed inside the email platform.
That makes the mailbox a core management object in email operations. Its configuration determines whether messages are delivered correctly, whether folders and rules behave as expected, and whether the mailbox can be shared or delegated without creating unnecessary exposure.
Mailbox access and delegation
Mailbox access is one of the main security dimensions because it controls who can read, send, move or archive messages. Shared access, delegated access and administrative access are distinct relationships, and each one can broaden the blast radius if permissions are too wide or poorly understood.
In many organisations, mailbox access is also tied to role assignment and lifecycle handling. When access is granted for support, finance, executive assistance or team continuity, the platform must still preserve clear ownership and revocation paths so that access does not outlive the business need.
For a broader control model around identification, authentication and access governance, NIST SP 800-53 Rev 5 Security and Privacy Controls provides a useful reference point for how organisations structure access control and auditability.
Provisioning, retention and mailbox governance
Mailbox administration usually includes provisioning, retention, delegation and access controls. Those choices matter because they determine how long content remains available, who can recover it, and whether deleted or archived mail is still subject to legal, operational or investigative requirements.
Governance becomes especially important where mailbox policy is used to support business continuity, records handling or supervision. A mailbox that is provisioned but not reviewed, or retained without a clear policy, can accumulate stale access, unnecessary data exposure and avoidable administrative overhead.
When mailbox governance extends into identity and privilege management, the lifecycle expectations described in the NIST Cybersecurity Framework 2.0 help anchor ownership, control and recovery responsibilities across the email environment.
Mailbox security, abuse and operational impact
Mailbox security matters because email remains a high-value target for credential theft, business email compromise and message tampering. A compromised mailbox can expose sensitive correspondence, confirm internal relationships, let an attacker impersonate the owner, and reveal recovery options or shared access paths that help extend the compromise.
The operational impact is often larger than the mailbox itself. Attackers may use mailbox access to reset other accounts, harvest attachments, divert invoices, or hide their activity by changing rules, forwarding settings or retention behaviour. Even when the mailbox is not the initial entry point, it is frequently a persistence and abuse surface.
Detection and response improve when mailbox activity is treated as part of the wider identity and access picture. That is why the NIST SP 800-63 Digital Identity Guidelines and the MITRE ATT&CK Enterprise Matrix are both relevant lenses for understanding how mailbox abuse connects to authentication compromise, persistence and lateral movement.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-2 — Account Management | Mailbox delegation and provisioning require controlled access assignment and revocation. |
| AU-2 — Event Logging | Mailbox activity needs audit records for sign-in, access and rule changes. | |
| IA-5 — Authenticator Management | Mailbox access depends on lifecycle handling of credentials, tokens and recovery paths. | |
| Recommendation — Apply AC-2 to review mailbox access, revoke stale delegation, and keep ownership current. Enable AU-2 logging for mailbox actions so investigations can reconstruct access and abuse. Use IA-5 to govern mailbox-related credentials, resets and credential lifecycle events. | ||
| NIST CSF 2.0 | PR.AA-05 — Identity and Access Management | Mailbox access is governed through identity, authentication and authorization controls. |
| Recommendation — Use PR.AA-05 to manage mailbox access, delegation and revocation through governed identity controls. | ||
| MITRE ATT&CK | T1114 — Email Collection | Compromised mailboxes are commonly abused for message collection and follow-on access. |
| T1078 — Valid Accounts | Mailbox compromise often uses stolen valid credentials rather than malware alone. | |
| Recommendation — Map mailbox abuse to T1114 and hunt for unauthorized collection, forwarding and rule changes. Investigate mailbox access under T1078 when legitimate accounts are used unexpectedly or from new locations. | ||
Practitioner Guidance
Why practitioners should care: Treat mailbox administration as a controlled security function, not a simple user-support task. The most common failures are stale delegation, overbroad access, weak review of shared mailboxes and retention settings that are not aligned to business or legal needs.
What to watch for: Review mailbox permissions, forwarding rules, administrative grants and unusual sign-in or sending behaviour together, because compromise often shows up first as a change in mailbox behaviour rather than as a visible outage.
Practitioner takeaway: The safest mailbox is the one whose ownership, access paths and retention rules are explicit, reviewable and easy to revoke when business need ends.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 3, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org