Email Security Risk Remains High

Tony MasonCyber Security, Data Protection, Email Security, Microsoft 365 Security

Email Security Risk Report

Almost every organisation reports experiencing email security incidents. Unfortunately, legacy approaches to technology and training can’t keep pace with evolving threats.

A recent survey by Egress highlighted that cybersecurity leaders remain vulnerable to both inbound phishing attacks and outbound data loss and exfiltration.  This is making them question the effectiveness of traditional approaches to email security.

94% of the 500 respondents experienced email security incidents in their Microsoft 365 environment in the last 12 months. This is similar to the results in 2022.

94% of these fell victim to phishing attacks, and 91% experienced data loss and exfiltration. 

It’s no wonder then, that 95% of cyber security leaders are stressed about email security. 

Phishing attacks sent from compromised supply chain accounts are the top cause of stress. Followed by internal account takeover (from credential harvesting).

Compromised accounts continue to put organisations at risk

58% of organisations experienced an account takeover.  79% of these starting with a phishing email that harvests an employee’s credentials.  83% even had MFA that was bypassed for the attack to succeed. 51% also fell victim to phishing attacks sent from compromised supply chains.


During 2023 it was impossible to talk about cybersecurity & phishing without talking about AI. Large language models (LLMS) and generative AI enable cybercriminals to easily create targeted and sophisticated phishing emails, as well as generate malware. Gone are the days of obvious spelling mistakes & bad grammar in phishing emails. Deepfakes & AI chatbots that can mimic natural human interaction, are now used to create phishing campaigns and at scale.

These more sophisticated phishing campaigns are now harder for both traditional perimeter defences and employees to detect. Cybersecurity leaders know they are becoming more vulnerable.

Such sophisticated phishing emails from compromised accounts can now get through reputation-based domain checks, carried out by traditional perimeter defences. 

With all of this, there is a sense of what we’ve been doing is no longer good enough.

Traditional Secure Email Gateways (SEGS)

Therefore, 87% of organisations advised that they were looking to move away from their traditional SEG. They are either considering or committing to replacing the SEG with Microsoft’s controls combined with an Integrated Cloud Email Security (ICES) Solution.

Organisations owe it to their employees to provide the right training and technology to detect advanced attacks.

Read the full report here