# 9. Email Security and Phishing Protection

We’re going to consolidate the two email-related bullets into one comprehensive deep-dive, because the questions you'd ask vendors and the questions you'd ask yourself about getting email security right are deeply intertwined. This will be one of the longer topics on the list because email is still the #1 attack vector and most organizations underinvest or buy the wrong things.

Context: Email is the most successful attack vector in history and remains so today. Despite 30+ years of "email is dead" predictions, 90%+ of breaches still start with a malicious email, a credential-harvesting link, or a business email compromise (BEC) wire fraud. The market has fragmented:

• Secure Email Gateways (SEGs), the legacy approach: Proofpoint, Mimecast, Barracuda. Sit in front of mail flow, scan inbound.
• Integrated Cloud Email Security (ICES) / API-based, the modern approach: Abnormal, Material, Avanan (now Check Point), Sublime. Plug into M365/Google via API, see all mail post-delivery, use ML for behavioral detection.
• Native platform protections, Microsoft Defender for O365, Google Workspace built-ins. Often "good enough" for many companies but rarely thought of as a full strategy.
• Awareness/training platforms, KnowBe4, Hoxhunt, etc. The "fix the human" angle.

The market reality: most companies are running 2015-era SEGs against 2026-era attacks and wondering why phishing keeps getting through. AI-generated phishing has destroyed the "look for typos" model entirely. BEC and vendor email compromise (VEC) bypass traditional content filters because they don't contain malware, they contain requests.

The right question isn't "are we filtering bad email?", it's "do we have a layered system that handles inbound threats, internal account takeover, BEC/VEC fraud, AND human behavior, and how do we know it's working?"

15 Questions to Ask Email Security Vendors (and Yourself)

1. "What's your detection architecture, gateway-based, API-based, or hybrid? And what does each see vs. miss?"
Why: This is the foundational question. Gateways scan inbound mail before delivery but can't see internal-to-internal email or post-delivery threats (account takeover, lateral phishing). API-based tools see everything but don't block in-flight. The answer affects what threats you can actually catch.
Good answer: Honest discussion of architectural trade-offs, hybrid approach, what each layer adds. Red flag: "Our [single approach] catches everything."

2. "How do you detect Business Email Compromise (BEC) and vendor email compromise (VEC), attacks with no malware, no malicious links, just convincing requests?"
Why: BEC is now the highest-dollar email threat by far ($50B+ in losses globally). Traditional content scanning is useless because there's nothing "bad" in the email content. Detection requires behavioral baselining, sender reputation, communication patterns, and intent analysis.
Good answer: Behavioral ML, communication graph analysis, anomaly detection on tone/context/request type, vendor relationship monitoring. Red flag: "Our content engine catches BEC."

3. "Show me real examples of attacks your platform caught in the last 30 days that legacy SEGs and Microsoft/Google native missed, with the actual email artifacts."
Why: This is the evidence test. Modern email security vendors should be catching dozens of attacks per customer per month that everything else missed. They should be eager to show you, with sanitized examples.
Good answer: Dashboards full of recent catches, sanitized examples readily shared, free assessment offered. Red flag: "Our customers don't typically share specifics."

4. "How do you handle account takeover (ATO) detection, when an attacker is inside a legitimate mailbox sending phishing from it?"
Why: Account takeover is the new normal. Once an attacker compromises a mailbox (often via MFA fatigue, AitM, or phishing), they send internal phishing from a trusted account. Gateway tools can't see it. API-based tools can.
Good answer: Native ATO detection, behavioral signals (impossible travel, unusual sending patterns, OAuth anomalies), automatic response. Red flag: "We rely on the IdP to detect ATO."

5. "What's your stance on links and attachments, sandboxing, time-of-click rewriting, in-line analysis, or all three?"
Why: Link-based phishing dominates volume. Time-of-click protection (rewriting URLs and re-checking when clicked) catches delayed activation; sandboxing catches malicious files. Both have trade-offs in user experience and detection delay.
Good answer: Multi-layered approach, time-of-click + sandboxing + behavioral analysis on clicked URLs, post-delivery clawback. Red flag: "We scan all attachments at delivery" (table stakes only).

6. "How do you handle internal-to-internal email, the lateral phishing scenario after one employee is compromised?"
Why: This is where SEGs are blind. They scan inbound. Once an internal account is compromised and sends phishing internally, traditional tools can't see it. API-based tools can; gateway tools fundamentally can't without architectural changes.
Good answer: Native internal mail visibility, lateral phishing detection. Red flag: "Our gateway protects all email" (then ask: how does it see employee-to-employee mail?).

7. "What's your false positive rate, and what's the user experience when something is wrongly quarantined?"
Why: Aggressive blocking generates false positives that erode user trust and create IT helpdesk load. Mature vendors measure FP rate and offer self-service release with appropriate friction. Bad vendors over-block and force IT into the middle.
Good answer: Published FP rate, self-service quarantine release with safety guardrails, smart digest workflows. Red flag: "Our FP rate is near zero" or "users open a ticket to release."

8. "How do you handle AI-generated phishing, perfectly written, contextually accurate, no typos, often spear-phishing scale?"
Why: AI has erased the visual indicators that trained users (and some legacy filters) looked for. "Look for misspellings" advice is dead. Detection now requires behavioral, contextual, and identity-based reasoning, not content-based.
Good answer: Honest discussion of how AI phishing changes the game, behavioral/contextual detection emphasis, ongoing model training against AI-generated lures. Red flag: "Our content engine catches it" or vague "we use AI to fight AI."

9. "Show me how you detect impersonation, both lookalike domains and display name spoofing, and how you handle legitimate edge cases (third parties, contractors, M&A entities)."
Why: Impersonation is the BEC bread-and-butter. CEO fraud, supplier impersonation, look-alike domains. Detection has to be sophisticated enough to catch attackers but not block legitimate similar-named partners or new acquisitions.
Good answer: Multi-signal impersonation detection (domain, header, behavior, communication graph), allowlisting for known partners. Red flag: "We block all lookalike domains" (will overblock and break business).

10. "How do you integrate with my SOC, SIEM, SOAR, IdP, and incident response workflows?"
Why: Email security in isolation is half a solution. The signals matter for SOC investigation; the response often involves identity, endpoint, and ticketing. Integration depth determines whether the tool plays well with the rest of your stack.
Good answer: Native integrations, bi-directional, with documented API and webhook capabilities. Red flag: "We export to CSV" or "integration is on the roadmap."

11. "How do you support DMARC, DKIM, SPF, and do you help me get my domains properly authenticated to prevent outbound spoofing of my brand?"
Why: Email authentication is foundational and often neglected. A vendor that doesn't help you with DMARC enforcement is leaving you exposed to brand impersonation against your customers, partners, and employees. Plus regulators (e.g., Google/Yahoo's 2024 sender requirements) now require it.
Good answer: DMARC management as a feature, guided rollout from p=none → quarantine → reject, BIMI support. Red flag: "DMARC is your responsibility to configure."

12. "What's the user experience for reporting suspicious emails, and what happens when they do?"
Why: User reporting is a critical detection signal. The button needs to be obvious, the process frictionless, and the back-end response intelligent (auto-triage, bulk clawback if confirmed malicious). A "report phishing" button that goes into a void is worse than none.
Good answer: Native button in Outlook/Gmail, automatic analysis, reporter feedback, bulk remediation across all inboxes if confirmed. Red flag: "Users forward to security@" with no automation.

13. "How do you handle awareness training, included, integrated, or separate? And what's your stance on simulated phishing?"
Why: Training and email security used to be separate categories; they're converging. Some vendors include awareness/training; some integrate with KnowBe4-class tools. The simulated phishing question is also philosophical, done badly, it punishes users; done well, it builds resilience.
Good answer: Integrated or strong partnership, just-in-time training tied to actual incidents, behavioral metrics, no shame-based culture. Red flag: "We just track click rates" (counterproductive measure on its own).

14. "How do you protect against email-borne supply chain attacks, when a legitimate vendor's account is compromised and sends a real-but-malicious invoice?"
Why: This is the cutting edge of email fraud. Real vendor, real conversation thread, real invoice, but the bank details have been changed, or the attachment is now malicious. Catching this requires understanding normal in vendor communications.
Good answer: Vendor relationship modeling, anomaly detection on invoice/payment changes, multi-channel verification prompts. Red flag: "We trust authenticated senders."

15. "What does success look like in 12 months, and what metrics should I be tracking that go beyond 'emails blocked'?"
Why: "Emails blocked" is a vanity metric (and partly a function of how noisy your inbound is). Real success metrics: catches missed by other tools, time-to-clawback, BEC attempts caught pre-payment, phishing report rates, user dwell time in suspicious mail, etc.
Good answer: A maturity model, mutually agreed KPIs, customer success engagement. Red flag: "We'll show you our dashboard."

🎯 The Meta-Test

• Q1, Q2, Q4, and Q6 separate modern email security from legacy SEGs. A vendor weak on these is selling a 2015 product.
• Q3 and Q15 are the credibility test. If they can't show you what they catch and how they measure success, they're selling a feeling.
• Q11 is the underrated foundational question. DMARC is free, fundamental, and still embarrassingly absent at most companies.

💡 The "Getting Email Security Right" Framework (Beyond Vendor Selection)

Email security isn't just a tool purchase, it's a layered architecture. Here's the honest framework I'd give a CIO/CISO:

Layer 1: Foundational hygiene (free or cheap, often skipped)

• DMARC at p=reject for all domains (yes, all of them, including parked and legacy)
• SPF + DKIM properly configured
• DNS hygiene (no dangling records, no abandoned subdomains that can be hijacked)
• Disable legacy auth (POP3, IMAP, basic auth) on M365/Google
• Enforce phishing-resistant MFA (FIDO2/passkeys, not SMS)

Layer 2: Native platform protections (turn on what you've already paid for)

• Microsoft Defender for O365 (especially P2) or Google Workspace Enterprise security features, turn on Safe Links, Safe Attachments, anti-phishing policies, mailbox auditing
• Most companies have these licensed and don't fully configure them

Layer 3: Modern email security (where most "regular" companies should focus their net new spend)

• API-based ICES tool layered on top of native, OR
• Modern SEG with ICES capabilities OR
• Skip third-party entirely if you're small + fully on M365 E5 with strong tuning (controversial but valid for some)

Layer 4: Identity & response coupling

• Email security signals must flow to your identity provider (so a phishing-clicked user can be auto-stepped-up or quarantined)
• Auto-clawback on confirmed malicious mail across all inboxes
• ATO detection feeding incident response

Layer 5: Human layer

• Awareness training, but not the punitive "we caught you clicking" version
• Just-in-time micro-training tied to real incidents (someone clicks a real or simulated phish → gets a 60-second teaching moment, not a public shaming)
• Easy reporting button + visible feedback ("You reported X; here's what we found")
• Build a culture where reporting is rewarded, not feared

Layer 6: Process & financial controls (the BEC kill switch)

• Out-of-band verification for any wire transfer, banking change, or unusual financial request, no exceptions
• Vendor banking changes require multi-channel confirmation
• Finance team trained on BEC patterns specifically (not generic phishing)
• Consider this layer as important as any technology

💡 Honest Observations

1. The biggest email security mistake I see isn't tool choice, it's assuming a tool replaces process. The most expensive ICES platform won't stop a wire transfer if your AP team doesn't have an out-of-band verification policy. Process and finance controls matter as much as tech.
2. Most "regular" companies overpay for legacy SEGs they no longer need. If you're fully on M365 or Google Workspace, the value of a separate gateway has diminished. The modern play is native + API-based ICES, not native + gateway. Many companies are paying for both gateway and ICES, the gateway is often the one that should go.
3. Phishing simulations done badly are net-negative. They train people to fear IT, not to spot phishing. They generate "click rates" that are vanity metrics. The mature programs measure report rates, how many users actively reported suspicious mail, not how many clicked. Reward the reporters, don't shame the clickers.
4. AI-generated phishing has fundamentally changed the game. Old user training said "look for typos and grammar." That advice is now actively misleading. New training emphasizes context, "Did you expect this? Does the request make sense? Verify out-of-band." Update your training accordingly.
5. DMARC is still neglected and it's embarrassing. Free, fundamental, takes weeks not months, prevents your brand from being weaponized against your own customers. If you have any "we'll get to it" items, this is the highest-ROI one to do this quarter.
6. The financial decision matters most for BEC, not malware. Most BEC losses happen because someone wired money based on a fraudulent request. The control isn't an email filter, it's an AP process. Your CFO is your most important security partner here. Make sure they know it.