Email Security After the Filter: A 2026 Decision Guide

Email security has an allocation problem. The discipline covers the whole set of controls that protect accounts, messages, and the people reading them, spanning sender authentication, filtering, encryption, and the response work that follows a message nobody blocked. Most budgets concentrate on the filtering half, and most of the expensive attacks that still land are not filtering problems.

Consider what a clean delivery looks like now. SPF passes, DKIM passes, DMARC aligns, the sender has an unremarkable reputation, there is no attachment and no URL, and finance changes a supplier's banking details anyway because the request arrived inside a real invoice thread. Nothing in that sequence is a detection failure. A better inspection engine does not address it. Investigation does, which is why improvements in AI phishing detection keep landing on the same unsolved problem.

TL;DR:

• The expensive attacks increasingly carry nothing to scan. A request to change payment details inside an existing thread has no attachment, no link, and clean authentication results.
• AI closed the craft gap without changing the physics. Polished, personalized attempts are cheaper to produce, so the same team sees more of them, and a share still arrive with no payload.
• After delivery, the clock runs against the defender. Someone can click and authenticate before the first report reaches anyone, and manual triage across separate tools finishes later still.
• The employee report is the signal most stacks handle worst. It arrives with practical context and no technical indicators, and it often lands in a queue nobody owns end to end.

Together these move the marginal email security dollar away from another filtering layer and toward faster investigation of what already arrived. The rest of this piece works through where that shift holds and where it does not.

Many Expensive Attacks Carry Nothing to Scan

Business email compromise produced $3.05 billion in losses across 24,768 complaints in the FBI's 2025 IC3 data, second only to investment fraud by dollar loss. Where that money goes has shifted sharply. Cryptocurrency was the transaction type BEC complainants reported most often last year, at 86%, against 7% for wire transfer and ACH combined. Attempt counts tell a different story from where the money lands, and both are worth holding: the Anti-Phishing Working Group's fourth-quarter data shows wire-transfer BEC attempts climbing steeply late in the year, while gift-card requests remained the more common ask by volume. The rails vary, and none of them requires a payload. Gateways inspect sender reputation and message elements such as attachments or URLs, and a BEC message may offer none of those to inspect.

Vendor email compromise makes the problem harder because the mail can be legitimate in every mechanical sense. Messages sent from a genuinely compromised supplier account, arriving as replies inside threads both parties have been reading for weeks, leave fewer conventional warning signs. The same is true of lookalike domains, which are domains the attacker controls and can therefore authenticate cleanly with their own valid SPF, DKIM, and DMARC records. In those cases, authentication results do not resolve whether the request itself is trustworthy. Deciding that requires knowing which supplier this is, what the payment terms were, and who is authorized to change them, none of which is available to a system that only reads the message. That gap is what makes business email compromise expensive long after the mail has been delivered.

Recent sender authentication mandates do less against these paths than their reception suggested. Gmail's bulk-sender requirements raise the baseline by requiring SPF and DKIM authentication and DMARC alignment, but the minimum acceptable DMARC policy is p=none, which monitors and enforces nothing. Exact-domain spoofing is also not the whole of phishing. The mandates raise hygiene across the email environment, and they generally do not address display-name spoofing, lookalike domains, compromised accounts, or social engineering that asks for a payment instead of a click.

AI Raised Attacker Quality and Volume at Once

Controlled spear-phishing research from TU Berlin found that LLM-generated personalized attempts almost tripled the click rate of generic phishing in its experimental setting. The same study found that manually crafted spear phishing still performed considerably better than the automated version, a detail that usually drops out when the study gets summarized. What AI changed was the cost of producing a message that reads well, not the ceiling on how persuasive a message can be.

That change in cost is the consequential one. A recent systematization of research on LLM-generated phishing describes generation scaling to minutes while detection lags behind it. Separate detection research suggests why. LLM output tends to be grammatically sound and contextually plausible, so the spelling errors and awkward phrasing that classifiers historically keyed on are often absent.

None of this warrants alarm. Google Threat Intelligence's adversarial AI tracking reports productivity gains and no breakthrough capabilities, with reconnaissance, lure writing, and localization getting faster while the underlying techniques stay recognizable. For a defender, that has a specific operational shape. The same team receives more higher-polish attempts, and some portion of those arrive with no payload, so the pressure lands on the investigation queue and not on the filter.

Give Native Filtering Its Due

Native platform protection remains a substantial part of an effective defense, and pretending otherwise erodes credibility with anyone who reads the data. Coordinated disruption works too. After Microsoft's action against the Tycoon2FA phishing-as-a-service kit, Microsoft's own quarterly telemetry, reported in trade coverage, put the decline in kit-linked phishing volume at 92% against pre-disruption averages. That figure comes from the vendor that ran the takedown, so treat the precise number carefully. The mechanism it describes is straightforward enough: remove the kit and the volume it was generating goes with it.

That reframes the investment question without settling it. Once native protection is well configured, the useful test is whether another filtering layer materially improves malicious-message detection or mostly reduces bulk and promotional noise. The second test asks what the surviving set of messages actually looks like. If it is small in percentage terms, expensive in consequence, and weighted toward the attacks that carry no payload, another classifier has little to act on, while additional investigation capacity acts directly on it.

After Delivery, the Clock Favors the Attacker

Users can click a phishing message and enter credentials before the first report reaches anyone. Reaching a verdict on that report is slower than producing it: Microsoft's documentation for its own triage tooling puts manual triage of a reported message at up to thirty minutes per alert, largely because investigators move across separate tools to assemble the picture. Meanwhile, if the credentials were live, movement from initial access toward other systems can begin well before the investigation closes.

Session theft compresses the window further. Adversary-in-the-middle kits proxy the entire authentication flow in real time, capture session cookies and access tokens, and replay them without triggering another authentication prompt, which is what makes non-phishing-resistant MFA insufficient here. Post-delivery remediation narrows the exposure without closing it, because the credential and the session are already gone by the time the message is pulled.

Report volume creates a second constraint on the defender's side. Every submission consumes investigation time whether or not it turns out to be malicious, and the queue does not sort itself. Automation can gather evidence, close the benign submissions on the strength of that evidence, and cluster duplicate reports of one campaign so the same investigation is not run repeatedly. In most environments that have already tuned their native controls, investigation throughput is the binding constraint, and detection coverage is not.

Where the Next Email Security Dollar Goes

The right investment depends on your program's current state, so the list below is an evaluation order and not a menu. Establish control maturity first, then work through loss exposure, operating capacity, staffing, and contractual obligations. The steps combine, and most programs will land on more than one.

1. If Native Controls Aren't Fully Configured, Harden Them First

Evaluate configuration debt on SPF, DKIM, DMARC, Safe Links, Safe Attachments, and anti-phishing policies before layering another filtering product over the native deployment. Configuration debt is cheaper to retire than a new contract, and an unconfigured control makes any comparison against a paid alternative meaningless.

2. If BEC and Vendor Fraud Drive Your Losses, Add an API-Based Behavioral Layer

For teams that need more business context in the decision, behavioral layers can evaluate per-employee and per-vendor patterns and internal mail flows, complementing rather than displacing the gateway. This can be justified when the exposure warrants it, and it presumes a team on the other side with the capacity to act on what the layer flags.

3. If You Run a Mature SOC With SIEM and SOAR, Automate Reported-Message Investigations

Automation here requires defined incident response workflows and sustained report volume to be worth building. Target investigations that reach evidence-based verdicts for reported messages, close benign submissions on those outcomes, cluster campaign duplicates into single incidents, and close the loop with the employee who reported.

4. If You Can't Staff Around-the-Clock Coverage, Buy Investigation as a Service

Assess the staffing and build time that in-house coverage actually requires before committing to it, since 24/7 coverage carries a headcount geometry that is easy to underestimate. Buying it carries its own known tradeoff. An external team that lacks business context may escalate too much and transfer the fatigue back to the internal team, so how a provider acquires that context is the thing to test in an evaluation.

5. If You Carry Archiving and Continuity Obligations, Gateways Still Earn a Place

Consider gateways when contracts require compliant archiving, e-discovery, legal hold, or outage continuity in the same deployment. The detection argument and the compliance argument are separate, and a gateway can lose the first while still winning the second.

Most programs end up combining configured native controls, a behavioral layer, and a deliberate answer to who investigates what gets through. The third of those is the one most often left implicit.

Phishing Investigation Is Separating From the Filter Stack

Phishing investigation increasingly operates as its own discipline instead of a feature bundled into detection. Service catalogs distinguish coverage for tool-generated email alerts from investigation of user-reported submissions, and dedicated products now focus specifically on abuse-mailbox workflows and campaign handling.

The split exists because user reports and tool alerts have different triggers, service levels, and data requirements. Teams should verify separately whether a service covers each, because the user-reported queue is the one that tends to fall through. Those submissions carry practical context and no technical indicators, which makes them awkward for tooling built to match indicators, and for a message with no attachment or URL the employee report may be the only usable signal available. Reaching a verdict on it requires telemetry combined with organizational and historic context that no header contains.

Policy and phishing-resistant MFA reduce risk, but they do not prevent compromise. When a credential is entered, an MFA code is shared, or a session token is captured, the problem is no longer the message. The work shifts to identity providers, cloud control planes, and SaaS systems, where the question becomes what access the attacker gained and what they did with it. At that point, the investigation is the same regardless of the initial delivery channel. The difference is whether the organization can correlate signals across those systems and reach a clear verdict without placing the burden back on the internal team.

Daylight is a MASS company, meaning it offers managed agentic security services for Security Operations. Its phishing coverage takes in submissions employees report themselves alongside alerts from email security tools, and investigates and responds to both.

Spend on the Verdict, Not Another Layer

The uncomfortable part of this argument is that it does not produce a purchase for most teams. It produces a question about where investigation capacity comes from. A team can build that capacity, buy it, or keep absorbing it informally while the reported-message queue grows, and the third is the one many programs are running without having chosen it. Filtering budgets are easy to defend because the line item maps to a product. Investigation capacity is harder to defend, and it is where the surviving risk lives.

So measure the residue instead of arguing about it. Take a month of messages that got through a well-configured stack, and a month of employee reports, and work out how long each took to reach a verdict and who did that work. If verdicts arrive slowly and the work is scattered across people whose job is something else, the next dollar has a clear destination, and it is not another scanner.

Frequently Asked Questions About Email Security

Is a Standalone SEG Still Worth Running on Microsoft 365?

Its detection value depends on whether the gateway materially improves malicious-message detection beyond configured native controls and any API-based behavioral layer, which is something you can measure rather than debate. Keep a gateway when archiving or continuity obligations require one, and evaluate that case on its own terms.

What Does Enforcing DMARC at p=reject Actually Stop?

It primarily stops exact-domain spoofing of your own domain. A lookalike domain the attacker registered can publish its own valid SPF, DKIM, and DMARC records and authenticate cleanly, and DMARC does not evaluate display names, so neither of those paths is affected.

What Should We Automate First in Phishing Response?

Reported-message investigation and campaign clustering. Initiate and complete an investigation for each submission, close the safe ones on evidence instead of on a rule of thumb, and group duplicate reports of one campaign into a single incident. Protect the reporting pipeline itself while doing it, because faster reporting is the goal and a slow or silent process discourages it.

Which Metrics Show Whether the Program Is Working?

Post-delivery numbers. Track delivery-to-remediation time, report-to-verdict time, and reporting rate. Reporting rates vary substantially across organizations and industries, which makes your own trend line and your loop-closure practice more useful than any single external benchmark.

Do AiTM Kits Make MFA Pointless?

No. MFA remains necessary, but a kit that proxies the login page in real time can capture and replay the resulting session token, which defeats implementations that are not phishing-resistant. Move high-value identities to phishing-resistant authentication, and build session and token analysis into account takeover response, because the attacker is stealing a session, not a password.