Email Security Concerns

Excited to finally share our first publication on the evolving email security market in 2026! This is one that I've wanted us to do for the longest time. For thirty years, email has been the cheapest way into the enterprise. Three decades of layered defense did not close that vector. Our SACR team just published "The New Architecture of Email Security in 2026." The central thesis of the report is that email security has officially evolved from basic content filtering into an identity-graph problem. It is about trust, identity, and human judgment inside the inbox and across the workflows that wrap around it. This modern battlefield is defined by trust (social engineering as we've seen), identity architecture, and business workflow abuse. Key takeaway for CISOs/security leaders reevaluating their email stack. Five shifts sit underneath that: 1️⃣/ The real thing is in relationships, timing, and whether a request fits normal business workflow. The signal left the message. BEC, VEC, account takeover, and OAuth abuse carry few traditional indicators of compromise. 2️⃣ / Email is an identity and data problem wearing an inbox. Phishing leads to credential theft, then SaaS access, then data exposure. The incident spans email, identity, and data even when it starts with one message. 3️⃣ / No single architecture wins. SEG, ICES, investigation, and agentic platforms coexist because they solve different parts of the problem. The question is not which is best. It is which combination reduces risk in your environment. 4️⃣ / Detection has commoditized. When every vendor claims north of 99 percent efficacy, the detection rate stops being a decision criterion. Explainability and response become the differentiators. Detection that does not produce action is telemetry. 5️⃣ / The perimeter is now human and machine. Social engineering follows work into Teams, Slack, WhatsApp, and the browser. As AI agents start reading inboxes and acting on requests, a 99 percent agent detection rate still leaves a 1 percent failure that programs have to plan for. The strongest email security programs over the next few years will not be the ones with the highest detection rates. They will be the ones that align behaviour, prevention, context, and response to business risk. Massive kudos to Anna Perrone for her research work! Our note highlight 4 vendors that serve as representative vendors that are leading this market: ▪️ Abnormal AI, ▪️ Mimecast, ▪️ Ocean, ▪️ Varonis Email Interceptor Each serves as a way to evaluate how your current defence model aligns with the realities of 2026. Read the full architectural map summary below (below): https://lnkd.in/gZZEpCBM #Cybersecurity #EmailSecurity #CISO #CloudSecurity #EnterpriseTech #InfoSec #AIAgents

🛡️ Beyond MFA: Defeating "Starkiller" and the Rise of Proxy-Phishing If you still view phishing as "static fake pages," your defense strategy is outdated. A new Phishing-as-a-Service (PaaS) called "Starkiller" is commoditizing Advanced Persistent Threat (APT) techniques for the masses. By using headless browsers and Docker containers to act as a Reverse Proxy, Starkiller doesn't just steal passwords—it hijacks the entire authenticated session in real-time. https://lnkd.in/eJ9BnK5w ⚔️ The Offensive Tactic: Real-Time Relay: >> The "Link Trick": Uses the @ symbol in URLs (e.g., login.microsoft.com@malicious.site) to trick users and bypass simple domain filters. >> Live Interception: It loads the real brand site in a headless Chrome instance. Every keystroke and MFA code is forwarded instantly. >> Session Theft: Once the victim completes MFA, the attacker captures the session cookies/tokens, gaining full account access without ever needing the password again. 🛡️ Defensive Controls: Moving to Phish-Resistant Architecture: >> Standard MFA (SMS, Push, TOTP) is no longer a "silver bullet" against proxy attacks like this. We must move up the stack: 1. Implement Phish-Resistant MFA: >> Shift toward FIDO2/WebAuthn (Passkeys) or hardware security keys (YubiKeys). These bind the authentication to the specific origin URL, making it impossible for a proxy to replay the credential. #HardwareSecurityModules 2. Network & Browser-Level Detection: >> AIP/Conditional Access: Enforce "Managed Device" requirements so that even a valid stolen session token cannot be used from an untrusted, unmanaged attacker IP. #ConditionalAccessPolicies >> URL Sandboxing: Deploy advanced email security that identifies the "URL Masking" pattern (user@domain) and inspects the final destination, not just the visible link. #EmailSecurityControls 3. Session Monitoring & Revocation: >> Treat session tokens as high-value targets. Shorten session lifespans and implement Continuous Access Evaluation (CAE) to revoke tokens immediately if a user's location or risk profile changes. #CAE 4. User Behavioral Coaching: >> Standard "don't click links" training isn't enough when the landing page is the actual Microsoft or Google site. Users must be trained to inspect the top-level domain in the address bar, regardless of how the page looks or behaves. #HumanCenteredAwareness The Bottom Line: Starkiller proves that cybercrime has reached enterprise-level maturity. We can't secure a 2026 threat landscape with 2016 defenses. #CyberSecurity #Infosec #MFA #ZeroTrust #Starkiller #Phishing #CISO #CloudSecurity

Phishing used to be easy to spot—bad grammar, generic greetings, and outlandish claims offering millions. But today, AI has changed the game. It is helping attackers craft flawless, personalized, and highly convincing messages that mimic real conversations. These emails don’t just look legitimate—they sound like your boss, your colleague, or your financial institution. With AI, threat actors can now: 🔹𝐒𝐜𝐚𝐥𝐞 𝐬𝐩𝐞𝐚𝐫-𝐩𝐡𝐢𝐬𝐡𝐢𝐧𝐠 𝐚𝐭𝐭𝐚𝐜𝐤𝐬 that once took time. 🔹𝐁𝐲𝐩𝐚𝐬𝐬 𝐭𝐫𝐚𝐝𝐢𝐭𝐢𝐨𝐧𝐚𝐥 𝐬𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐦𝐞𝐚𝐬𝐮𝐫𝐞𝐬 like keyword-based spam filters and URL detection techniques. 🔹𝐄𝐱𝐩𝐥𝐨𝐢𝐭 𝐭𝐫𝐮𝐬𝐭 𝐚𝐧𝐝 𝐮𝐫𝐠𝐞𝐧𝐜𝐲 by posing as senior executives, vendors, or IT support The result? Employees are no longer just skimming suspicious emails—they’re engaging with them. Traditional defences like spam filters and one-time security awareness training aren’t enough to stop it. Organizations need a multi-layered email security strategy that goes beyond outdated methods. ✅ 𝐈𝐧𝐯𝐞𝐬𝐭 𝐢𝐧 𝐀𝐝𝐯𝐚𝐧𝐜𝐞𝐝 𝐓𝐡𝐫𝐞𝐚𝐭 𝐃𝐞𝐭𝐞𝐜𝐭𝐢𝐨𝐧 Adopt solutions that leverage real-time behavioural analytics and machine learning to identify anomalies in email communication. ✅ 𝐄𝐧𝐡𝐚𝐧𝐜𝐞 𝐄𝐦𝐩𝐥𝐨𝐲𝐞𝐞 𝐓𝐫𝐚𝐢𝐧𝐢𝐧𝐠 Transition from generic phishing awareness to targeted training that exposes the evolving tactics of AI-powered attacks. Simulated phishing exercises that mimic current threats can help build resilience. ✅ 𝐈𝐦𝐩𝐥𝐞𝐦𝐞𝐧𝐭 𝐌𝐮𝐥𝐭𝐢-𝐅𝐚𝐜𝐭𝐨𝐫 𝐕𝐞𝐫𝐢𝐟𝐢𝐜𝐚𝐭𝐢𝐨𝐧 Encourage protocols such as secondary confirmation for sensitive transactions or requests, particularly those that deviate from the norm. ✅ 𝐑𝐞𝐠𝐮𝐥𝐚𝐫𝐥𝐲 𝐔𝐩𝐝𝐚𝐭𝐞 𝐚𝐧𝐝 𝐓𝐞𝐬𝐭 𝐃𝐞𝐟𝐞𝐧𝐬𝐞𝐬 Cybersecurity isn’t a set-it-and-forget-it deal. Continuously refine your email security protocols and conduct regular assessments to ensure your defences adapt to emerging threats. AI has made phishing smarter. Are we making our defences smarter, too? #EmailSecurity #CyberSecurity #AI

🔐 Strengthening Defenses Against Phishing Threats Phishing remains one of the most persistent and evolving cyber threats organizations face today. Attackers exploit human trust through deceptive emails, malicious attachments, and fraudulent links—making it critical for cybersecurity professionals to adopt robust tools for analysis and defense. The right toolkit not only aids in identifying phishing attempts but also helps in building proactive strategies to safeguard digital assets. 📧 Email Header Analysis Tools Email headers often reveal the hidden story behind suspicious messages. Tools such as MailHeader.org, MXToolbox, Google MessageHeader, and Gaijin Analyzer provide deep insights into sender legitimacy, routing anomalies, and authentication failures. Leveraging these platforms is the first step in dissecting phishing campaigns at their core. 🌐 URL, IP, and Domain Reputation Checking Phishing links are gateways to credential theft and malware delivery. With solutions like AbuseIPDB, VirusTotal, Talos Intelligence, and URLScan.io, analysts can uncover malicious reputations, sandbox suspicious domains, and monitor threat intelligence feeds. Coupled with WHOIS lookups from DomainTools or SecurityTrails, these checks establish vital context around potential attacks. 🖥️ File and Malware Sandboxing Attachments remain a favorite vector for attackers. Tools like AnyRun, Hybrid Analysis, Cuckoo Sandbox, and VMRay enable behavioral analysis of files in safe, controlled environments. These sandboxes allow analysts to observe malicious payloads in action—without compromising internal systems—while accelerating incident response timelines. 🤖 Automated & Intelligence-Driven Defense Platforms such as PhishTool, CyberChef, PhishTank, and OpenPhish help automate detection and enrich phishing intelligence. Combined with resources like CISA’s red-flag guidelines and communities such as HaveIBeenPwned, organizations can stay ahead of emerging tactics. Training employees with these insights fosters a culture of cyber resilience, where prevention is just as important as response. #CyberSecurity #Phishing #EmailSecurity #ThreatDetection #IncidentResponse #CyberAwareness #InfoSec #MalwareAnalysis #PhishingPrevention #ThreatIntelligence #DigitalForensics #NetworkSecurity #DataProtection #OnlineSafety #PhishingAwareness #CyberDefense #SecurityTools #EthicalHacking #SOC #CTI #RedTeam #BlueTeam #CyberThreats #CyberHygiene #RiskManagement #CISO #CyberSecCommunity #CloudSecurity #CyberSafe #EmailForensics #MalwareDetection #ZeroTrust #CyberResilience #InfosecTools #PhishingSimulation #EndpointSecurity #ITSecurity #CyberSecTraining #PhishingProtection #SocialEngineering #SecurityAwareness #CyberExperts #PenTesting #FraudPrevention #CyberOps #CyberStrategy #ITRisk #SecureEmail #SecurityResearch #DefendDigital #CyberStrong

I've watched email security evolve for over 25 years as a CEO, CIO, and CISO, and now at a VAR providing solutions. We have had gateways, then API-based inbox tools, then behavioral ML. Each generation got better at one thing. Scoring the message in the inbox. And attackers stopped caring. Verizon's DBIR found the median user clicks a phishing email in under 60 seconds. By the time that email lands, the attacker has already done the real work. The lookalike domain registered weeks ago. The fake LinkedIn profile impersonating your vendor. The vishing call to your helpdesk last Tuesday. The email is not the attack. It's the opening move. And no inbox-only tool can see what came before it. That's why Doppel's new Email Security announcement caught my attention. I took a hard look at it this week, and the video below largely covers my take. Here are a few things stood out to me: - It connects the message to the campaign. Their Threat Graph maps attacker infrastructure outside the inbox, domains, certs, fake profiles, and uses that context to score what lands inside it. - It doesn't stop at detection. It executes takedowns on the sending infrastructure behind the phish, so the same campaign doesn't just retarget you tomorrow. - The detection logic is readable. Plain-language policies instead of blackbox ML or a pile of brittle YARA rules your team is afraid to touch. Any SOC leader knows how much time that buys back. Here's my honest read and feel. Detection alone stopped being a strategy a while ago. Attackers run campaigns. Defenders score messages. That mismatch is why the breaches keep happening, and it won't close until defense moves upstream of the inbox. Doppel seems to be building for that fight. Watch the video for more details, then ask yourself this question: Is your email security stack still scoring messages, or is it disrupting threatening campaigns? #Cybersecurity #EmailSecurity #DoppelPartner #AI #CISO #SocialEngineering #Doppel

It’s 2026. If phishing is still a training problem in your company, you’ve already lost. Let’s be honest. Phishing is no longer a “user awareness” problem. It’s a business architecture problem. And most companies are still treating it like a yearly training exercise. 🎣 Phishing Is an Entry Point — Not the Endgame Attackers don’t care about your inbox. They care about: Credential theft Session hijacking Lateral movement Financial fraud Data exfiltration Email is just the delivery mechanism. If your defense strategy starts and ends with “don’t click suspicious links” — you’re already behind. What Real Phishing Prevention Looks Like in 2026 It’s layered. Structural. Measurable. 1️⃣ Human Layer Continuous simulations. Behavioral metrics. Reporting culture without fear. 2️⃣ Identity Layer Mandatory phishing-resistant MFA (FIDO2 > SMS). Conditional access. Device trust. 3️⃣ Email Authentication Layer SPF, DKIM, DMARC — properly enforced, not just configured. Spoofing prevention. External tagging. 4️⃣ Detection Layer Secure email gateways. Link detonation. Attachment sandboxing. AI-driven anomaly detection. 5️⃣ Web & DNS Layer DNS filtering. Real-time domain reputation. Browser isolation for high-risk users. 6️⃣ Response Layer One-click reporting. Automated account lockdown. Token/session revocation. Forensic visibility. 7️⃣ Governance Layer Metrics that matter: Click rate Report rate Time-to-contain Repeat offender analysis If you can’t measure it, you can’t improve it. Phishing succeeds less because users are careless… …and more because companies still rely on single-layer defenses. Defense-in-depth isn’t optional anymore. It’s survival. So let me ask you: Is phishing prevention in your company still “training-focused” — or is it engineered into your identity and security architecture? Let’s talk. 👇 #Cybersecurity #Phishing #ZeroTrust #IdentitySecurity #SecurityLeadership #RiskManagement

The right to #defense is not only a procedural guarantee. It is an ecosystem of independence — and today that independence inevitably extends to the #technological infrastructure we rely on. After a long and deliberate assessment, I decided to change the entire email architecture of my practice, moving away from a hybrid system based on internally managed Linux servers combined with Gmail, and transitioning to Proton Mail. This was not a matter of convenience or branding. It was a defensive choice. Those of us working in international criminal defense know this well. When you confront intelligence services, security agencies, politically exposed prosecutions, or cross-border cases involving state interests, technological fragility is never neutral. In these contexts, digital vulnerability is not a technical inconvenience. It is a structural threat to: • the confidentiality of the lawyer–client relationship, • the strategic autonomy of the defense, • the credibility of the lawyer as an independent professional. I no longer find it acceptable to reconcile the duty of confidentiality with systems that allow — even theoretically — automated content scanning, profiling, or jurisdiction-driven access. Nor do I consider it prudent to depend on infrastructures exposed to #unilateral political decisions. Recent history has shown how fragile the illusion of platform neutrality really is. Centralized systems, extraterritorial leverage, and sudden political measures can disable institutions and defenses overnight. What happened to the International Criminal Court is not an anomaly — it is a precedent. For this reason, I believe that protecting professional integrity at the highest level today also means accepting a difficult choice: implementing state-of-the-art security systems that may be less mainstream, less frictionless, and operationally more demanding — but far more consistent with our constitutional role as defense lawyers. This is not technophilia. It could be legal ethics applied to the 21st century. The independence of the legal profession is not defended only in courtrooms or public statements. It is defended through: • infrastructure choices, • communication architectures, • conscious efforts to reduce systemic dependencies and attack surfaces. This path is not easy. It involves costs, friction, and organizational change. But anyone who defends against powerful state apparatuses cannot afford technological naivety. This is not an explanatory post. It is a statement to fellow lawyers: The quality of defense today is also built here.