Email sits inside important decisions
Email is more than a messaging channel. It carries password resets, invoices, contracts, customer requests and instructions between people who may never meet. An attacker does not need to defeat every technical control when a believable message can persuade one person to disclose credentials, change bank details or approve a payment. That is why email security must protect both the mailbox and the business process around it.
Treat the credible display name, familiar thread and urgent tone as untrusted inputs rather than proof of identity. Processes involving money, credentials, confidential information or supplier changes need independent verification. A known telephone number, an approved workflow or a second authorised person provides a decision boundary outside the email conversation.
Use layers that fail differently
Strong multi-factor authentication makes stolen passwords less useful, while secure configuration of mail authentication helps receiving systems evaluate whether a domain was authorised to send a message. Filtering and link protection can remove known malicious content; managed devices and timely updates reduce what happens if a user opens something dangerous. No single layer covers impersonation, compromised legitimate accounts and new attack infrastructure.
Administrative controls matter too. Limit mailbox delegation, monitor automatic forwarding and suspicious inbox rules, review third-party applications and protect domain and DNS administration. Separate administrator identities from ordinary mail use. The goal is to reduce both the chance of compromise and the freedom an attacker has after gaining access.
Design reporting for the moment of doubt
People need a fast, blame-free way to report a suspicious message or a mistake. The instruction should be simple, visible and practised: stop interacting, report the message and use a known alternate channel for urgent business. Reports must reach a team or provider with the authority and information needed to investigate. If reporting disappears into an unattended mailbox, employees will stop using it.
Training works best when tied to real decisions rather than fear. Teach staff how invoice fraud, credential harvesting, consent prompts and conversation hijacking appear in their working context. Explain what the organisation expects when a payment request changes suddenly or an executive appears to bypass procedure. Reinforce successful reporting as evidence that the system worked.
Respond across identity, mail and money
A suspected compromise may require session revocation, password reset, multi-factor review, removal of attacker-created rules, inspection of delegated access and third-party applications, and a search for related messages. Preserve evidence before deleting artefacts. If a fraudulent payment may have occurred, financial institutions and authorised decision-makers should be contacted through established channels without waiting for a perfect technical picture.
Notify affected people and consider legal or regulatory duties with qualified advice. Use out-of-band communication if the mailbox or collaboration environment cannot be trusted. The response owner should record decisions, timestamps and evidence so that containment, recovery and later review remain coherent.
Measure outcomes, not activity
Useful measures include how quickly credible reports reach responders, whether critical mail domains are authenticated, how many accounts can still use weak pathways, how long dormant forwarding rules remain and whether payment-change procedures are followed. A high training-completion rate is not proof that the organisation can resist or recover from a real event.
Review incidents and near misses without reducing the explanation to user error. Ask which control could have interrupted the path earlier, which approval was ambiguous and what evidence was unavailable. Email security improves when identity engineering, mail configuration, financial controls, reporting and incident response are managed as one system.
What to do next.
- ✓Require independent verification for payment and bank-detail changes.
- ✓Protect mailboxes with strong multi-factor authentication.
- ✓Deploy domain authentication and monitor unauthorised senders.
- ✓Review forwarding, delegation and third-party app access.
- ✓Give every employee a simple reporting route.
- ✓Practise the first hour of mailbox compromise response.
Use guidance responsibly
Technology, provider behaviour and legal requirements change. Validate implementation details against current official documentation, test changes safely and obtain qualified legal advice where required.
Zanele Dlamini
Threat Awareness ContributorExplores email risk, human decision points and layered safeguards that help organisations resist common attack paths.
More from this writer