Email Security Dos and Don'ts: The Complete Guide to Protecting Inboxes from Phishing, BEC, and AI-Powered Cyber Threats

Email security dos and don'ts decide whether an organization's employees stop a phishing cyberattack at the inbox or hand cyberattackers the credentials, data, and access they came for. The gap between those two outcomes is rarely technical. It is the difference between an employee who pauses to check a sender address and one who acts on a convincing request under time pressure.

According to the FBI Internet Crime Complaint Center's Internet Crime Report 2025, business email compromise (BEC) accounted for $3.046 billion in reported losses across 24,768 incidents, averaging roughly $123,000 per case. Those losses were not caused by unpatched servers. They were authorized by people who believed the message in front of them.

This guide covers:

• The email security dos and don'ts that govern authentication, passwords, and access hygiene on every account.
• How employees recognize phishing, BEC, and credential harvesting before acting, and what to do in the minutes after a click.
• Encryption, secure file handling, and the email security dos and don'ts that keep sensitive content protected in transit and at rest.
• Organizational controls including SPF, DKIM, DMARC, sandboxing, forwarding restrictions, and lifecycle governance.
• Monitoring, auditing, and incident response practices that shorten detection and containment.
• How cybersecurity awareness training converts written email security dos and don'ts into reflexive employee behavior.
• AI-era defenses, regulated-industry obligations, and the metrics that prove human risk is falling.

Written rules change nothing until employees act on them under pressure. Adaptive Security turns email security dos and don'ts into practiced behavior through AI-native phishing simulations.

Take a self-guided tour

Authentication and Access Hygiene: The Email Security Dos and Don'ts That Hold the Front Door

Authentication and access hygiene determine whether a cyberattacker walks through the front door or gets stopped at it. Three controls carry most of the weight: multi-factor authentication on every account, passphrases managed through a password vault, and strict discipline on shared, public, and unmanaged devices. Each one blocks a specific and well-documented intrusion path, and skipping any single one leaves a gap that credential-theft tooling is purpose-built to find.

These are the email security dos and don'ts that everything else depends on.

DO: Enable Multi-Factor Authentication on Every Email Account

Multi-factor authentication (MFA) requires two or more verification factors before an account opens: something the user knows such as a password, something the user holds such as a phone or hardware token, and in high-security environments something the user is, such as a fingerprint or face scan. With MFA active, a stolen password stops being sufficient on its own.

The effect is measurable. According to Microsoft's Security at Your Organization guidance, more than 99.9% of compromised accounts lack multi-factor authentication, which leaves them exposed to password spray, phishing, and credential reuse cyberattacks. For every thousand account compromises an organization absorbs, at least 999 could have been stopped by a second factor.

Not every MFA method offers equal protection, and security teams should understand the hierarchy before standardizing on one. SMS-based one-time codes sit at the bottom because they are vulnerable to SIM-swapping, in which a cyberattacker socially engineers a mobile carrier into moving the victim's number to a device the cyberattacker controls. In December 2024, the FBI and CISA formally advised organizations to stop using SMS as a second factor, citing its lack of encryption and its susceptibility to interception.

Authenticator applications that generate time-based one-time passwords remove the SIM-swap vector because the code is produced locally on the device. Hardware security keys built to the FIDO2 standard sit at the top of the hierarchy and are phishing-resistant by design. A hardware key authenticates only against the service it was registered with, so a convincing lookalike login page cannot persuade it to release a usable credential.

Email accounts deserve the strongest available factor because they function as the master key to password resets across nearly every other service an employee touches. A cyberattacker who takes over one unprotected inbox can chain resets through banking, CRM, HR, and cloud infrastructure accounts within minutes. According to Verizon's 2026 Data Breach Investigations Report, stolen credentials were involved in 13% of all breaches, which places credential protection at the center of any serious email defense.

DO: Use Passphrases and Password Managers

Modern password guidance has moved decisively away from complexity mandates, the familiar requirement to mix uppercase, lowercase, digits, and symbols, toward length as the primary strength determinant. NIST Special Publication 800-63B now directs verifiers to permit passwords of at least 64 characters and to accept all printable ASCII characters including spaces, an explicit endorsement of passphrases as a practical way to create long secrets that people can actually remember.

A passphrase is a sequence of unrelated words rather than a short string stuffed with symbol substitutions. At a minimum of 16 characters, four or more randomly chosen dictionary words produce a search space far larger than an eight-character password built from predictable substitutions. Cyberattackers already know every one of those patterns, and modern cracking hardware tests billions of hashes per second, so length is what makes the keyspace impractical to exhaust.

Password managers close the remaining gap by eliminating reuse, which is the root cause of credential stuffing. When every account holds a unique, machine-generated secret inside an encrypted vault, a breach at one service stops cascading into breaches at ten others. The user never needs to memorize or type the generated credential, which removes the cognitive burden that pushes people back toward reuse in the first place.

DON'T: Reuse Passwords, Skip MFA, or Stay Signed In on Shared Devices

Credential reuse is the fuel behind credential stuffing at industrial scale. Cyberattackers take username and password pairs exposed in one breach and replay them against dozens of other services using automated tooling that spreads requests across proxy networks to avoid rate limits and detection. When a reused password unlocks an email account, the cyberattacker gains both the inbox and the ability to reset every service linked to it.

Skipping MFA on accounts that feel low-value creates the same exposure through a different door. Cyberattackers routinely pivot from unremarkable accounts, an old vendor portal or a shared marketing login, toward higher-value systems once they hold any foothold. According to Verizon's 2026 Data Breach Investigations Report, 62% of confirmed incidents involve a human element, which is precisely why every account with access to company data needs a second factor without exception.

Public Wi-Fi introduces a separate problem in session hijacking. On an unencrypted open network, a cyberattacker running a packet capture can intercept authentication tokens sent in cleartext and take over an active session without ever learning the password. Mandating VPN use for employees working outside the office encrypts that traffic and renders intercepted packets unreadable.

Screen locking and sign-out discipline complete the picture. Devices should auto-lock after no more than five minutes of inactivity, and employees should lock manually whenever they step away.

Shared and public machines such as hotel business centers, library terminals, and borrowed laptops should never hold persistent sessions, which means signing out of every account after use, clearing the browser cache, and declining any prompt to be remembered on a machine outside the employee's control. Reinforced through cybersecurity awareness training, these habits close the distance between written authentication policy and how devices actually get used.

Strong authentication policy collapses the moment employees sign in on an unmanaged device and stay there. Adaptive Security measures those behaviors and corrects them.

Explore the platform

Phishing Recognition and Reporting: Email Security Dos and Don'ts for Spotting and Stopping Cyber Threats

Effective phishing defense reduces to three actions performed consistently: inspect every inbound message before acting on it, refuse to open links and attachments from unverified sources, and report anything suspicious immediately. None of these behaviors is innate, and all three can be trained. According to the FBI Internet Crime Complaint Center's Internet Crime Report 2025, phishing and spoofing generated 191,561 complaints, the highest total of any reported crime category, which shows how much volume reaches inboxes before any employee makes a decision.

1. DO: Inspect Every Email Before Trusting It

Most phishing emails survive technical filtering because they look legitimate at a glance. The cyberattacker's objective is reflexive trust, getting the recipient to act before scrutinizing anything. A three-second pause to check sender identity, link destination, and emotional register is the highest-value habit any employee can build.

Sender verification comes first. Display-name spoofing is trivial: a cyberattacker sets the display name to a real executive's name while the actual sending address belongs to an unrelated consumer domain. The display name reads correctly in the email client preview, and only the expanded address exposes the fraud.

Every employee should hover over or tap the sender name on any unexpected request involving funds, credentials, or sensitive data.

Link inspection is the second non-negotiable check. A hyperlink can display a familiar login URL while pointing somewhere else entirely, often using a zero in place of the letter O or an extra subdomain that reads as legitimate at speed.

Mobile interfaces make this harder, which is why cyberattackers time credential-harvesting campaigns for commutes and lunch hours when targets are on phones. If the destination cannot be previewed, the message should not be clicked; navigating to the service through a saved bookmark achieves the same result safely.

Urgency is the emotional signature of phishing. Messages that demand immediate action, threaten account closure within hours, or invoke an executive deadline are engineered to bypass deliberate evaluation.

Spear phishing campaigns sharpen this further by folding in details gathered through open-source intelligence (OSINT), such as a conference the target attended or a project name lifted from a public profile. Legitimate organizations do not threaten account deletion or demand wire transfers by email alone, so a physical sense of panic is itself the signal to stop.

Grammar and tone anomalies remain useful cues, though generative AI has eroded much of their value. AI-composed messages are clean and stylistically convincing, so what still flags them is tonal mismatch: an executive who normally writes two-line replies suddenly sending three formal paragraphs, or a colleague switching spelling conventions mid-thread. These micro-inconsistencies are considerably harder to fabricate than correct grammar.

Credential-harvesting pages deserve specific attention because they represent the highest-volume category. According to the Anti-Phishing Working Group's Phishing Activity Trends Report Q1 2025, 1,003,924 phishing cyberattacks were observed in the quarter, with financial and online payment services together representing 30.9% of all activity. The lure usually arrives as a fake login notification, a shared-document request requiring re-authentication, or a password-expiration warning, and the landing page is a pixel-accurate copy of the real service.

The domain is what gives it away. Employees should be trained to read the rightmost portion of the hostname before entering credentials, because a string such as login.microsoft.com.verify-portal.net belongs to the final domain in the string, which is a verification portal owned by whoever registered it. That single reading habit defeats the majority of lookalike pages regardless of how convincing the page design is.

BEC operates differently and requires a different instinct. There is no malicious link to inspect because the email itself is the weapon, sent either from a genuinely compromised executive account or from a close-enough spoof, carrying a plain-text request for a wire transfer, a payroll change, or a confidential document.

The red flags are procedural: a deviation from the standard payment workflow, a request to skip an approval step, or an insistence on confidentiality. The only dependable defense is out-of-band verification, meaning a phone call to a number already on file.

2. DON'T: Click Links from Unknown Senders or Open Unexpected Attachments

The most dangerous phishing payloads arrive through attachments and links that slip past reputation-based filtering. Attachments from known senders warrant the same scrutiny as those from strangers, because compromised vendor accounts have become a primary delivery route. The sender is genuine and the conversation history is genuine; only the attachment is hostile.

When a trusted partner's mailbox is breached, every organization in that partner's contact list becomes a downstream target. The message often continues an existing thread, and the attached revised invoice or contract amendment carries information stealers, ransomware loaders, or remote access tooling.

File type matters enormously here: password-protected archives, ISO disk images, and HTML attachments are all chosen specifically to defeat automated scanning, since an encrypted archive cannot be inspected by most gateways at all. The password supplied in the message body completes the illusion of care.

QR codes embedded in email are a particularly effective delivery mechanism because they force a device switch. A code cannot be hovered, previewed, or inspected the way a hyperlink can, so scanning it with a phone camera reveals nothing before the browser opens.

The employee lands on a credential-harvesting page on a personal device, enters corporate credentials, and does so entirely outside the visibility of managed endpoint controls. Any unsolicited message containing a QR code should be treated as hostile until confirmed through a separate channel.

HTML attachments carry comparable risk through a different mechanism. Opening one renders a convincing replica of a login page inside the browser while executing locally, so the address bar may show a local file path rather than a remote domain, or a redirect may fire fast enough that no one registers it. Either way, anything typed into the form is exfiltrated immediately, which is why blocking HTML attachments at the gateway is a reasonable default policy.

The rule for attachments is simple and needs constant reinforcement: a file that was not explicitly requested should not be opened without verification. Contacting the sender through a channel other than email, whether a phone call, a chat message, or a separate thread the employee initiates, adds under a minute to the workflow and removes the most common attachment-based compromise path entirely.

3. DO: Report Suspicious Emails and Act Fast After a Compromise

Reporting a suspicious email is the single most valuable action an employee can take, and it should never be framed as an admission of failure. A phish alert button embedded directly in the email client lets employees flag a message in one click, routing it to the security team for analysis while removing it from the inbox. That mechanism converts the workforce into a distributed detection network.

The compounding effect is what makes reporting so valuable. When one employee flags a campaign that reached ten thousand inboxes, the security team can classify it and purge it organization-wide before the remaining recipients ever open it.

Speed decides the outcome, because cyberattackers move faster than most response processes assume. According to the CrowdStrike 2026 Global Threat Report, average adversary breakout time, the window between initial access and lateral movement, has fallen to 29 minutes, with the fastest observed at 27 seconds.

When a click does happen, the response has to be immediate and mechanical. Disconnect the device from the network by disabling Wi-Fi, unplugging Ethernet, or switching to airplane mode, which severs any active command-and-control channel before lateral movement begins. Reset credentials for every account entered into the phishing page or accessed from the device, starting with email and single sign-on, then run a full malware scan before reconnecting.

Notification is the step employees delay most often, usually out of embarrassment, and that delay is exactly what the cyberattacker is counting on. The minutes between credential theft and account takeover are when persistence gets established: forwarding rules that silently copy every message to an external address, follow-up phishing sent from the compromised account to colleagues and customers, and modified MFA settings that register a device the cyberattacker controls. Reporting a click within five minutes produces a fundamentally different incident than reporting it five hours later.

Employees should also know what a compromised account looks like from the inside. The recognizable indicators include unfamiliar forwarding rules, sent items nobody remembers sending, unexpected MFA prompts or new device registrations, and password reset confirmations the user never requested. Phishing simulations that score reporting behavior rather than click avoidance alone turn these steps from written policy into practiced reflex.

Recognition without reporting leaves the security team blind to campaigns already sitting in other inboxes. Adaptive Security scores reporting speed and coaches the employees who hesitate.

Book a demo

Encryption and Secure Data Handling: Email Security Dos and Don'ts for Protecting What Leaves the Inbox

Email encryption is a layered decision about where data stays protected rather than a single switch to flip. Transport-layer encryption secures the connection between mail servers, while end-to-end encryption locks the message content so that only the sender and the intended recipient can read it.

Most organizations need both, with transport encryption as the universal baseline and end-to-end protection layered onto communications carrying health information, financial records, intellectual property, or personal data. The email security dos and don'ts in this section govern what happens to sensitive content after it leaves the composer window.

DO: Encrypt Sensitive Emails and Attachments

Transport Layer Security (TLS) is the default protocol protecting email in transit between servers. When a message travels through a modern mail provider, TLS encrypts the connection from the device to the mail server and, in most cases, onward to the recipient's server, which prevents interception across the open internet.

TLS is a hop-by-hop protocol, however, so the message is decrypted and re-encrypted at every relay point. If any intermediate server lacks TLS support or treats it as optional, the message can silently fall back to plaintext without either party being notified. That failure mode is the reason transport encryption cannot be treated as a complete answer for confidential content.

End-to-end encryption closes the gap, and two standards dominate. S/MIME relies on certificates issued by a certificate authority, which suits enterprise environments where IT already controls certificate distribution through Microsoft 365 or Google Workspace, and recipients' email clients handle decryption automatically. PGP uses a decentralized trust model in which users generate their own key pairs and exchange public keys directly, giving it independence from institutional infrastructure at the cost of a steeper learning curve.

S/MIME is the more practical choice for most organizations because it integrates natively with common clients, scales across thousands of users through centralized certificate management, and satisfies compliance frameworks that require auditable encryption. PGP suits smaller technical teams and professionals who need encryption that does not depend on a corporate or governmental authority. Neither standard encrypts metadata, so subject lines and addressing remain visible and policy must forbid sensitive detail in subject lines.

DO: Use Cloud Storage Links Instead of Emailing Sensitive Files

Attachments are the weakest point in any email encryption strategy. Even when the message body is protected, an attached contract, spreadsheet, or patient record persists in the recipient's inbox, in the sender's sent folder, in every forwarded thread, and in every backup archive indefinitely. One compromised mailbox exposes every attachment that mailbox ever received.

Access-controlled cloud storage links remove that persistence. Uploading the file and sharing a link keeps control over who opens it, for how long, and whether they may download, forward, or print it. Links can be revoked instantly, access can be restricted to verified recipients inside the domain, and expiration dates make a forgotten link in an old thread useless after a set period.

The practice also limits exposure during a business email compromise. According to IBM's Cost of a Data Breach Report 2025, customer personally identifiable information was compromised in 53% of breaches, the most frequently stolen data category, and much of that data sits in mailboxes as attachments long after the business need has passed. A revoked link cannot be opened by a cyberattacker who compromises the recipient's account weeks later, while an attachment can.

DON'T: Assume TLS Alone Is Sufficient for Sensitive Data

TLS is necessary and insufficient at the same time. It protects data moving between servers and does nothing for data resting on them, which means a confidential message becomes plaintext the moment it lands on the recipient's mail server, accessible to administrators, backup operators, and anyone who compromises that infrastructure. An organization treating transport encryption as its only layer is one server breach away from exposing every sensitive message it has ever sent.

The distinction carries the most weight for regulated data. Entities transmitting protected health information, privileged legal documents, or non-public financial information cannot satisfy their obligations with TLS alone, because those frameworks require data to remain protected wherever it resides rather than only while it moves.

Encryption should be paired with a disciplined backup regimen. Email archives belong in encrypted, access-controlled storage with restoration tested quarterly, so that a ransomware event on the mail server or a misconfigured retention policy does not become an unrecoverable loss. Encryption defends confidentiality; backup defends availability; together they cover the full data-protection lifecycle.

Sensitive attachments outlive the conversations that created them and sit in mailboxes indefinitely. Adaptive Security trains employees on secure handling before the exposure becomes permanent.

Take a self-guided tour

Organizational Email Authentication Protocols: DMARC, SPF, DKIM, and the Email Security Dos and Don'ts of Domain Defense

Domain spoofing remains one of the most exploited routes into an organization because it requires no malware and no stolen credentials. A missing or misconfigured DNS record is enough.

Security teams close the gap by deploying three authentication protocols, adding sandboxing for attachment-level cyber threats, and locking down the auto-forwarding and message-revoke settings cyberattackers rely on for exfiltration. None of these controls demands new infrastructure, though each requires ongoing maintenance and a deliberate progression from monitoring to enforcement.

DO: Implement SPF, DKIM, and DMARC

These three protocols form the authentication tripod that tells receiving mail servers whether a message genuinely originated from the sending domain. All three belong in the deployment, because leaving any one out preserves a gap that cyberattackers already know how to use.

SPF (Sender Policy Framework) is the simplest of the three, a DNS TXT record listing every IP address and third-party service authorized to send on behalf of the domain. According to DMARCguard's Email Authentication Adoption Study 2026, which scanned 5,499,028 domains, SPF shows the highest adoption of any protocol at 56.0%, largely because it requires only a single record, while 4.8% of SPF-enabled domains exceed the ten-lookup limit defined in RFC 7208 and fail authentication silently as a result.

SPF alone provides limited protection because it validates only the envelope sender rather than the "From" header a recipient actually sees, which means a cyberattacker can pass SPF while still displaying a forged sender name. Every SaaS platform sending mail on the organization's behalf consumes one or more DNS lookups toward the limit, so consolidating services and using subdomain-specific records prevents the silent failure mode.

DKIM (DomainKeys Identified Mail) attaches a cryptographic signature to each outbound message. The sending server signs with a private key, the receiving server verifies against the public key published in DNS, and any alteration in transit breaks the signature. Adoption lags well behind SPF at 22.7% of domains in the same study, because DKIM requires key generation, DNS publishing, and configuration across every service that sends mail. That complexity is also the reason it matters, since DKIM survives forwarding in situations where SPF frequently does not.

DMARC (Domain-based Message Authentication, Reporting, and Conformance) is the policy layer binding the other two together. It instructs receiving servers what to do when authentication fails and where to send aggregate reports identifying who is sending mail using the domain. DMARC also requires alignment, meaning that either SPF or DKIM must pass and the authenticated domain must match the visible "From" domain; without it, SPF and DKIM results are informational only and no action follows a failure.

The adoption data exposes a dangerous enforcement gap. DMARCguard's study found that 30.4% of domains publish a DMARC record while only 12.8% enforce a policy of p=quarantine or p=reject, which leaves the substantial majority of the internet fully spoofable despite two years of pressure from major mailbox providers.

The correct rollout starts at p=none, which generates reports without blocking anything. Running that policy for at least 30 days while analyzing aggregate reports identifies every legitimate sending source that needs authorization, and missing one risks breaking real mail flow. Once every source is accounted for, moving to p=quarantine routes failures to the spam folder, and after several weeks without false positives the domain can graduate to p=reject, at which point no major provider will accept a spoofed message from it.

DO: Deploy Email Sandboxing and Consider a Secure Email Gateway

Authentication protocols stop domain spoofing and do nothing about a malicious attachment sent from a legitimate but compromised account. Sandboxing and gateway inspection cover that second problem.

Email sandboxing, also called detonation, routes suspicious attachments into an isolated virtual environment where they are opened, executed, and observed before reaching the inbox. The sandbox records registry changes, outbound connections, spawned processes, and file writes, then quarantines anything that behaves maliciously and releases anything that does not. The approach catches zero-day malware, macro-laden documents, and password-protected archives that signature-based filtering misses for lack of a known hash.

A secure email gateway provides broader pre-inbox filtering including spam detection, URL rewriting with time-of-click analysis, malware scanning, and policy-based data loss prevention. Traditional gateways sit inline as an MX-record hop, while modern API-based layers integrate directly with Microsoft 365 and Google Workspace, analyzing mail after acceptance and before the user sees it. The API model also enables retrospective remediation, pulling a message from every inbox it reaches once a cyber threat is identified after delivery.

The two approaches work best in combination. A gateway or API layer catches known-bad patterns at volume while sandboxing handles the unknown, whether that is an attachment no signature has seen or a link that resolves to a benign page today and a credential harvester tomorrow. Organizations relying on built-in provider defenses alone should understand the trade-off, since native protections tune toward preserving mail flow while a dedicated layer applies deeper and slower inspection.

DON'T: Allow Unrestricted External Auto-Forwarding or Ignore Email Revoke Gaps

Auto-forwarding rules are among the simplest and most reliable exfiltration channels available to a cyberattacker. Once an account is compromised, the adversary creates an inbox rule that silently copies all incoming mail to an external address. The legitimate user notices nothing while the cyberattacker reads every sensitive conversation in real time.

According to Red Canary's 2025 Threat Detection Report, email forwarding rules ranked as the sixth most prevalent technique across its customer base and affected 9.2% of monitored organizations. Adversaries name these rules with single characters, repeated dots, or generic labels that disappear into long rule lists, and they frequently configure the rule to delete the forwarded copy from sent items, removing the most obvious evidence.

The remedy is direct: disable external auto-forwarding at the tenant level, which both Microsoft 365 and Google Workspace support globally. Where some external forwarding is a genuine business requirement, restrict it to an approved domain list and monitor for exceptions. Alerting on mailbox rule creation events, specifically the operations that create or modify inbox rules and forwarding addresses, surfaces compromise within minutes in place of weeks.

Message revoke capability addresses the other half of the outbound risk. When an employee sends sensitive data to the wrong recipient, or when a compromised account is discovered after mail has already gone out, the ability to pull messages back from recipient inboxes keeps a mistake from becoming a breach. Native recall functions carry real limits, typically working only inside the same organization and only before the message has been read, so organizations should verify that their posture covers both prevention through forwarding restrictions and response through revoke.

A domain published at monitoring-only policy is as impersonable as a domain with no DMARC record at all. Adaptive Security closes the human gap those spoofed messages exploit.

Explore the platform

Access Management and Lifecycle Governance: Email Security Dos and Don'ts for Controlling Who Gets In

Every mailbox in an organization is a door, and access governance decides how many doors exist, who holds keys, and whether those keys stop working the moment someone leaves. The work starts with an audit of every permission attached to every mailbox, then moves to a system that grants minimum necessary access at onboarding, reviews it on a schedule, and revokes it automatically at departure. One lingering former-employee account with delegated access to a shared finance mailbox can become the entry point for a business email compromise that costs more than the entire governance program.

1. DO: Apply Least Privilege to Email Account Permissions

The principle of least privilege applies to email exactly as it applies to any other resource: every user holds only the permissions their role requires and nothing beyond that. In practice this means examining administrative rights, mailbox delegation, shared mailbox access, and application integration permissions with the same rigor applied to database credentials. A marketing coordinator has no need for global administrator rights across the tenant.

Excess permission is a path waiting to be exploited. When a single privileged account is compromised through phishing, the blast radius extends to every mailbox that account can open, every distribution list it can edit, and every mail flow rule it can alter. According to the UK Department for Science, Innovation and Technology's Cyber Security Breaches Survey 2025, 68% of businesses restrict administrative and access rights to specific users, which means close to a third do not, and the figure for mailbox delegation specifically tends to be worse.

Mapping permissions to job functions is the practical method. Finance teams need shared invoice mailboxes while having no business reason to read HR onboarding correspondence.

Executives may need delegate access for scheduling where assistants require no full mailbox rights, and external vendors should receive narrowly scoped application permissions in place of broad mailbox read access. Auditing these assignments quarterly catches the delegations that made sense during a busy close and stopped making sense a month later.

2. DO: Automate Offboarding to Immediately Revoke Email Access

Manual offboarding creates a window between someone leaving and their access disappearing. Inside that window, a former employee can forward client correspondence to a personal account, pull intellectual property from shared mailboxes, or watch active deal negotiations. Depending on a manager to file a ticket is a wager on departing employees behaving well.

The exposure is documented. A 2025 USENIX SOUPS study found that 48% of businesses are aware that former employees still hold access to internal systems, and 20% have suffered data breaches as a direct result of that access.

Direct integration between the HR information system or identity provider and the email platform closes the window. When an employee's status changes to “terminated,” the change should trigger an automated cascade: password reset, session revocation across every active device, removal from all distribution groups and shared mailboxes, and conversion of the mailbox to a restricted state that only authorized reviewers can open.

Organizations that connect identity systems to email platforms through SCIM provisioning and automated workflows eliminate the most common source of lingering access. Where multiple platforms are in play, integrations that support a single authoritative identity record propagate changes everywhere at once. When offboarding fails instead, former employees keep reaching third-party services through corporate single sign-on, shared mailbox contents stay readable on devices nobody wiped, and forwarding rules persist indefinitely.

3. DON'T: Use Work Email for Personal Matters or Neglect Mobile Device Governance

Using a work address for loyalty programs, forum registrations, and newsletter subscriptions creates cross-contamination between corporate and personal identity. A breach at any of those consumer services exposes an address that cyberattackers can then target directly, and any credential overlap between the two contexts turns a consumer breach into a corporate one. Each personal use case adds exposure the security team cannot see or control.

Mobile access carries the same logic. When corporate email reaches a personal phone without mobile device management or at minimum mobile application management, the organization loses visibility into whether the device is patched, encrypted, or locked at all, and a stolen phone with an active mail session is an open mailbox in a stranger's hands. Enrollment should be a precondition of synchronization, with device encryption, screen lock requirements, and selective remote wipe of corporate data enforced as baseline policy.

Separating personal and professional email limits the blast radius of either compromise. A breached personal account should not become a route into the corporate environment through password reuse or account recovery flows, and a breached corporate account should not expose an employee's private life. Conditional access rules that block consumer mail services on managed devices and require compliant device posture for corporate mail turn that principle into an enforced control.

Offboarding handled by ticket queue leaves former employees reading corporate mail for days. Adaptive Security keeps access discipline visible alongside human risk across the workforce.

Book a demo

Monitoring, Auditing, and Incident Response: Email Security Dos and Don'ts for When Things Go Wrong

Detection and response are where email security dos and don'ts stop being preventive advice and become operational discipline. The work involves instrumenting the mail environment for login anomalies, forwarding rule changes, and mailbox permission modifications, then routing those signals into a SIEM where they can be correlated rather than reviewed in isolation. A documented and rehearsed response plan determines what happens in the hours after the first alert fires, and the gap between a rehearsed plan and a filed one is measured in weeks of recovery and millions in cost.

DO: Implement Email Activity Monitoring and Regular Security Audits

Email environments change constantly as users grant mailbox permissions, create rules, and sign in from new devices and locations. Most of that activity is legitimate, and some of it is the opening move of an account takeover.

Login anomaly detection is the foundation. Impossible-travel sign-ins, authentication from known-malicious address ranges, and unusual patterns such as a finance employee signing in at 2 a.m. from a country they have never connected from all deserve alerting. Identity providers surface these signals natively, though the value comes from correlation: one anomalous sign-in is noise, while an anomalous sign-in followed thirty seconds later by a new external forwarding rule is a breach in progress.

Forwarding rule monitoring deserves its own cadence. Rules created by cyberattackers survive password changes and routinely go unnoticed for weeks while exfiltrating password reset links, wire confirmations, and customer correspondence. Forwarding configurations should be reviewed weekly in preference to quarterly, with automated alerts on any rule directing mail outside the organization's domains.

Mailbox permission changes follow the same pattern, since a sudden grant of full-access or send-as rights to an unfamiliar account can indicate lateral movement or a persistent adversary consolidating position. Tracking those changes in real time and tying each one to an accountable owner through identity governance turns a silent modification into a reviewable event.

Quarterly compliance audits close the loop by reviewing delegated permissions, transport rules, connector configurations, and administrative role assignments against a known-good baseline, with every finding and remediation documented. Board-level attention makes those audits stick. According to the World Economic Forum's Global Cybersecurity Outlook 2026, 52% of organizations report that board members receive regular cybersecurity updates, and 30% of board members in high-resilience organizations hold personal liability for breaches compared with 9% in low-resilience organizations.

DO: Maintain a Documented Incident Response Plan with Predefined Escalation Protocols

An email-breach response plan is an operational document in place of a PDF in a shared drive. It tells every stakeholder what to do, whom to call, and how to communicate when a mailbox is compromised, a phishing campaign succeeds, or a business email compromise results in a fraudulent transfer.

Roles come first. The plan names a primary incident commander, a technical lead for containment and forensics, a legal and compliance liaison, and a communications owner, each with a named backup and a current phone number stored outside the email system the incident may have compromised. A plan that instructs responders to coordinate over the same identity provider the adversary controls is obsolete before it is opened.

Communication templates prevent improvisation under pressure. Pre-drafted notifications for internal stakeholders, affected customers, regulators, and the cyber insurance carrier remove the risk of someone composing a legally sensitive disclosure at 3 a.m. while the incident is still unfolding, and they keep every spokesperson working from the same language.

Containment steps must be specific and ordered. An account takeover calls for a forced password reset, revocation of all active sessions, removal of forwarding rules, and quarantine of the affected mailbox, while a successful campaign that harvested credentials across many users expands to organization-wide session revocation and targeted resets for everyone who clicked. Each step should be written so that a responder who has never run the playbook can execute it without asking questions.

Evidence preservation is non-negotiable. Mailbox audit logs, message trace data, authentication telemetry, and the original phishing messages should be captured before any containment action that might destroy forensic artifacts, because that evidence is what legal counsel, the insurer, and potentially law enforcement will need.

Notification obligations vary by jurisdiction and by contract. GDPR requires notification within 72 hours of awareness of a personal data breach, and state-level breach notification laws in the United States impose separate timelines, so the plan must identify which regimes apply, who the notification officer is, and what starts the clock.

Post-incident review closes the loop. Within two weeks of containment, a blameless retrospective should establish what allowed the incident, what slowed or accelerated the response, and which changes to monitoring, cybersecurity awareness training, or controls would prevent recurrence, with findings distributed and the plan updated accordingly.

DON'T: Wait for a Breach to Define the Response Process

The cost difference between organizations that rehearse response and those that improvise it is quantifiable. According to IBM's Cost of a Data Breach Report 2025, breaches with a lifecycle exceeding 200 days cost an average of $5.01 million compared with $3.87 million for those contained faster, a 29% penalty applied entirely to organizations that discovered the problem late.

That penalty is the operational cost of missing muscle memory. Responders who have made containment decisions under simulated pressure move faster than responders reading a playbook for the first time, and communications leads who have delivered a difficult disclosure in a tabletop exercise write cleaner notifications when it counts.

Automated detection compounds the advantage. The same IBM analysis found that organizations using AI and automation extensively across security operations saved an average of $1.9 million per breach and shortened containment by roughly 80 days relative to organizations without those capabilities. Monitoring infrastructure makes internal detection possible while a rehearsed plan makes that detection actionable, and an organization lacking both discovers the breach when the ransom note appears.

Quarterly tabletop exercises should force real decisions in place of talking points. One quarter can simulate a business email compromise where a fraudulent transfer has already executed; the next can simulate a compromised executive mailbox with board correspondence exposed. Legal, finance, communications, and the executive sponsor belong in the room, because the technical fix is only one dimension of a live incident and the plan that works on paper is rarely the plan that works at 2 a.m.

Response plans that have never been rehearsed fail at the moment they are needed most. Adaptive Security exercises the human layer that every containment step depends on.

Take a self-guided tour

Security Culture and Cybersecurity Awareness Training: Making the Email Security Dos and Don'ts Stick

A technically flawless email stack fails the moment an employee clicks a link they were trained to recognize. According to IBM's Cost of a Data Breach Report 2025, phishing was the most frequent initial cyberattack vector, responsible for 16% of breaches at an average cost of $4.8 million per incident. Technical controls and human vigilance are complementary layers rather than competing budget lines, and neither works without a culture that keeps employees engaged, confident, and willing to speak up.

DO: Conduct Regular, Role-Specific Cybersecurity Awareness Training

Generic annual modules produce an illusion of preparedness. After a standard compliance course, employees can usually recite the definition of phishing and still miss a well-constructed spear phishing message in their own inbox, because recognition under time pressure is a different skill from recall on a quiz.

Completion metrics are part of the problem. As NIST computer scientist Julie Haney and University of Maryland Associate Professor Wayne Lutters concluded in their peer-reviewed analysis published in Computer (October 2020), compliance metrics do not tell the whole story and fail to measure whether a program produces sustained change in employee attitudes and behaviors.

A one-size-fits-all module delivered once a year cannot build the pattern recognition employees need against a convincing, context-aware message. A finance team member working invoice fraud scenarios needs different practice from a developer facing fake credential-reset requests or an executive targeted with business email compromise impersonation. Continuous phishing simulation at unpredictable intervals, tuned to the cyberattack patterns each department actually faces, builds the reflex that static slide decks never will.

DO: Build a Blame-Free Reporting Culture

An employee who hesitates to report a suspicious message for fear of discipline is a larger liability than one who clicks and immediately raises the alarm. Punitive responses to phishing failures suppress reporting rates directly, which is the opposite of what a detection program needs, and organizations that replace punishment with corrective coaching consistently see faster reporting and shorter dwell time.

The scale of losses makes that speed valuable. According to the FBI Internet Crime Complaint Center's Internet Crime Report 2025, internet crime drove $20.877 billion in reported losses, a 26% increase over the prior year, and a meaningful share of those losses trace back to incidents nobody flagged until money had moved.

Psychological safety is what converts a hesitant employee into a reporting one. When people know that raising a mistake triggers supportive coaching, they report within minutes in preference to hoping nobody notices, and every report, whether the employee clicked or not, generates incident data that helps the security team spot emerging campaigns and tune detection. Framing employees as an active sensor network in preference to a standing liability is what makes that participation sustainable.

DON'T: Treat Cybersecurity Awareness Training as an Annual Checkbox

Annual compliance courses create a rhythm cyberattackers understand well. Employees complete a module in November, pass a multiple-choice quiz, and return to their inboxes with no reinforcement until the following year, by which point whatever recognition they briefly built has decayed. Industry reporting consistently finds that the large majority of phishing messages reaching inboxes are never reported at all, which shows how much of the outcome still rests on unassisted employee judgment after automated filtering has done its work.

Treating AI-powered email tooling as a replacement for the human layer compounds the problem. Automated detection catches high-volume, pattern-following cyberattacks efficiently, while trained employees catch the outliers: the spear phishing message referencing a real vendor relationship, the business email compromise mimicking an executive's writing style, the credential-harvesting link inserted into a thread the cyberattacker already controls.

Neither layer is sufficient alone, which is why cybersecurity awareness training that runs continuously, with frequent role-specific phishing simulation and immediate feedback, is what converts the human layer from a vulnerability into a functioning defensive capability.

An annual module in November does nothing for an employee facing a convincing request in March. Adaptive Security runs continuous, role-specific cybersecurity awareness training instead.

Explore the platform

AI, Zero Trust, and the Next Generation of Email Security Dos and Don'ts

The cyber threat landscape now includes adversaries who can generate thousands of flawless, context-aware phishing messages in minutes, which is not what most current security stacks were architected against. According to Sumsub's Identity Fraud Report 2025-2026, sophisticated fraud surged 180% year over year across deepfakes, synthetic identities, and telemetry tampering, with deepfake cyberattacks rising 2,100% globally. Perimeter-based filtering and annual modules were built for a slower adversary than the one organizations now face.

DO: Adopt Zero-Trust Email Security Principles

Zero trust inverts the default posture of email architecture so that nothing is trusted by default and every message, sender, and attachment earns verification before delivery. Applied to email, the principle reshapes three layers at once.

Continuous authentication replaces the assumption that a correctly formatted message from a known domain is legitimate, making SPF, DKIM, and DMARC enforcement points in preference to optional configurations. A message that clears authentication is still untrusted; it has simply qualified for the next stage of inspection.

Micro-segmentation of email access ensures that a finance employee never receives an unsolicited transfer request from an executive account without additional verification signals, however convincing the message reads. Behavioral baselining then establishes what normal communication looks like for every role and flags deviations before a user ever sees the message, so that a first-ever late-night payment request from a CFO to an accounts payable clerk triggers quarantine.

Traditional perimeter models treated external as suspicious and internal as trusted, a binary that collapsed once remote work dissolved network boundaries and cyberattackers began launching campaigns from compromised internal accounts. A zero-trust architecture treats every message as potentially hostile until runtime analysis says otherwise, which cuts off the lateral movement that business email compromise and credential harvesting depend on.

DO: Use AI and Machine Learning for Cyber Threat Detection

Signature-based filters match patterns while AI-powered email security reads intent, and the distinction decides outcomes. Generative phishing messages carry no known malicious hashes, no blacklisted domains, and no misspellings for a rule to catch. What they do carry is linguistic manipulation: urgency calibrated to bypass hesitation, writing style cloned from genuine executive correspondence, and context pulled from open-source intelligence that makes the request feel routine.

Detection engines analyze three signal categories at once. Language pattern analysis compares phrasing, vocabulary density, and sentence rhythm against known legitimate correspondence from the purported sender, so an email that reads like the CEO but uses syntax the CEO has never produced gets flagged. Metadata analysis examines sending infrastructure, time-of-day patterns, and reply-to mismatches that people overlook, while behavioral analysis tests whether the request itself deviates from established organizational workflow.

Governance has to travel alongside the tooling. According to IBM's Cost of a Data Breach Report 2025, one in six breaches involved cyberattackers using AI, with AI-generated phishing accounting for 37% of those incidents. Detection capability alone does not compensate for ungoverned AI adoption inside the organization, which is why discovery of unsanctioned AI use belongs in the same program as inbound filtering.

DON'T: Underestimate Generative AI's Impact on Email Cyber Threats

Generative AI has not made phishing incrementally better; it has changed what phishing is. Large language models now write spear phishing messages that reference real projects, mirror actual writing styles, and pass every surface-level authenticity check employees were taught to apply, while the same tooling automates open-source reconnaissance across professional networks and corporate sites faster than any human operator could. An IBM X-Force experiment needed five prompts and five minutes to produce a campaign nearly as effective as one that took human experts 16 hours to build.

That velocity breaks legacy programs in two directions at once. Static modules refreshed annually cannot track techniques that change weekly, and filters built on signature databases cannot catch polymorphic campaigns where every message is a unique variant.

The internal exposure is just as significant as the inbound one. According to the National Cybersecurity Alliance's Oh Behave! The Annual Cybersecurity Attitudes and Behaviors Report 2025-2026, 58% of employed participants reported receiving no cybersecurity awareness training on the security or privacy risks of AI tools, despite 65% now using AI and 43% admitting to sharing sensitive work information with those tools. The gap concentrates risk exactly where organizational visibility is weakest.

Selection criteria should follow organizational scale. Smaller teams benefit most from platforms that deploy through API integration without MX record changes and bundle detection with automated employee cybersecurity awareness training.

Mid-market organizations need role-based phishing simulation that tests finance against invoice fraud, executives against impersonation, and IT staff against credential harvesting inside a single risk view. Enterprises should require multi-channel simulation across email, voice, and SMS, OSINT-driven personalization that mirrors genuine reconnaissance, and board-ready reporting that expresses human risk reduction in terms leadership can act on.

Cyberattackers now generate flawless, personalized messages faster than any annual module can be revised. Adaptive Security simulates those AI-generated cyber threats before employees meet them for real.

Book a demo

Email Security for Regulated Industries and Cloud-Native Organizations

Regulated and cloud-native organizations face requirements that generic guidance does not address, and the difference is the burden of proof. Regulated entities must map every email control to a specific clause and produce auditable documentation on demand, while cloud-native organizations must navigate a shared responsibility model in which the provider secures infrastructure and the customer remains accountable for configuration, access, and data protection.

Both environments converge on the same conclusion: when email security fails, the organization owns the outcome regardless of which vendor operates the mail platform. The email security dos and don'ts in regulated contexts are therefore evidentiary as much as technical.

DO: Align Email Security Practices with HIPAA, PCI DSS, GDPR, and Other Frameworks

Regulatory frameworks dictate specific technical and administrative safeguards, and absence of those safeguards triggers enforcement rather than a recommendation. The HHS Office for Civil Rights proposed sweeping revisions to the HIPAA Security Rule in January 2025 that would require regulated entities to encrypt electronic protected health information by default, deploy multi-factor authentication, maintain detailed audit trails, and conduct annual compliance audits, moving encryption from an addressable specification to a mandatory one.

Each framework maps to specific email controls. HIPAA-covered entities must encrypt protected health information both in transmission, using TLS 1.2 or higher, and in storage, with documented key management procedures. PCI DSS v4.0 requires cardholder data sent over open networks to be rendered unreadable through strong cryptography and mandates access logging that records who accessed what and when.

GDPR adds a data minimization dimension, since email retention schedules must be defined, justified, and enforced and holding personal data longer than necessary is itself a violation. Across all three regimes, regulated organizations must retain audit trails proving that cybersecurity awareness training was delivered, that phishing simulation was conducted, and that employees acknowledged acceptable-use policies.

Documentation is the control that proves every other control exists. A living email security policy should reference each applicable clause, log every configuration change, and tie specific technical controls to their regulatory rationale, so that an auditor asking how email-borne cyber threats are mitigated receives a document in place of a verbal account.

DO: Address Cloud-Specific Email Security Considerations

Cloud-hosted email introduces a shared responsibility boundary that many organizations misread until a breach exposes it. Microsoft 365 and Google Workspace secure the underlying infrastructure while the customer alone configures anti-phishing policies, enables encryption, manages access permissions, and monitors for anomalous activity. A default setting left unchanged, an over-permissioned service account, or an unreviewed forwarding rule can expose months of correspondence.

The financial exposure concentrates in specific markets. According to IBM's Cost of a Data Breach Report 2025, the average breach cost in the United States reached $10.22 million, driven by regulatory penalties and slower detection, which raises the stakes on every configuration decision inside a cloud mail tenant.

API-based email security holds a decisive advantage over legacy MX-rerouting architectures in cloud environments. Integration with Microsoft 365 and Google Workspace deploys in minutes without redirecting mail flow, preserving existing delivery guarantees while adding detection, automated remediation, and user-reported phishing triage inside the native inbox. The model removes the latency and single-point-of-failure risk that accompanies gateway-based deployment and lets security teams pull malicious messages organization-wide in one action.

Migration is the moment configuration risk peaks. Tenant-wide settings, connector rules, external forwarding defaults, and OAuth application consent policies all multiply the cyberattack surface, so every cloud email migration should trigger a full configuration audit covering mailbox delegation, transport rules, and API permissions.

DON'T: Overlook Physical Security or Assume the Cloud Provider Handles Everything

The provider secures the data center and the customer secures everything else, a boundary that admits no exceptions. Hardened facilities with biometric access and redundant power matter very little when an employee opens corporate email on an unlocked device in a coffee shop or a clinician leaves a workstation signed into a patient portal in an open corridor. Physical security of email endpoints sits squarely with the organization, and regulated environments add workstation standards that HIPAA's physical safeguards explicitly require.

Organizations running on-premises or hybrid mail infrastructure carry the same obligation at the server level through locked racks, access logs, entry controls, and decommissioning procedures that prevent recovery from retired drives. Fully cloud-native organizations still owe device-level enforcement covering screen lock timeouts, full-disk encryption, and remote wipe, because every endpoint reaching cloud email is a physical surface the provider cannot touch.

The most dangerous assumption in cloud email security is that shared responsibility ends at user management. Configuring DMARC, DKIM, and SPF, enabling advanced anti-phishing policies in place of accepting defaults, and monitoring for unusual sign-in locations and suspicious inbox rules all belong to the customer. No provider will call to report that a forwarding rule has been quietly exfiltrating mail for six months, and closing that detection gap is the highest-return investment available in cloud email security.

Auditors ask for evidence that employees were trained rather than assurances that policy exists. Adaptive Security produces that record automatically alongside compliance training.

Take a self-guided tour

How Email Security Dos and Don'ts Shape Broader Human Risk Posture

Email behavior is the largest single determinant of an organization's human risk exposure, because more than 90% of successful cyberattacks begin with a phishing email according to CISA. Every pause before a link, every reported message, and every out-of-band verification lowers the cyberattack surface, and every bypassed rule raises it. What employees practice in the inbox does not stay there.

Why Email Behavior Is the Foundation of Human Risk

Email remains the primary route through which cyberattackers establish initial access, which makes inbox behavior the front line for every organization. An employee who opens a weaponized attachment is demonstrating a susceptibility pattern, and the same cognitive blind spot resurfaces during a phone-based social engineering attempt or a fraudulent SMS.

The connection is structural. Business email compromise and credential harvesting teach cyberattackers which employees respond to urgency, which defer to authority without verifying, and which skip protocol under deadline pressure. Those signals then inform multi-channel campaigns in which the same target receives a spear phishing email, a follow-up voice call using a cloned executive voice, and a deepfake video meeting request inside a single cyberattack chain.

Email habits therefore function as a leading indicator of total human risk. An organization with low reporting rates, high phishing simulation click-through, and inconsistent verification discipline is almost certainly exposed to voice, SMS, and video-based social engineering as well, because the inbox is simply where the behavioral pattern shows itself first.

How Cybersecurity Awareness Training Turns Rules Into Behavioral Change

Knowing a rule and applying it under pressure are different capabilities. A finance employee can recite the requirement to verify every transfer request through a second channel and still approve a fraudulent invoice when a cloned executive voice follows the email with a call demanding speed. The gap between knowledge and action widens under cognitive load, time pressure, and perceived authority.

Closing it requires more than annual policy acknowledgment. Continuous phishing simulation exposes employees to realistic scenarios including credential phishing, vendor impersonation, and executive deepfake voicemail in a controlled setting where failure becomes a coaching moment. When an employee clicks a simulated link, an immediate microlearning module addressing that specific technique anchors the lesson in lived experience in place of abstract policy.

The deepfake dimension is escalating quickly. According to Sumsub's Identity Fraud Report 2024, deepfake fraud incidents grew four times year over year, which is why voice and video scenarios now belong in the same cybersecurity awareness training program that covers the inbox.

Open-source intelligence adds precision to that targeting. Analyzing what cyberattackers can discover about each employee from public professional activity, conference appearances, and social posts identifies who is most likely to face personalized spear phishing, and concentrating advanced phishing simulation on those individuals reduces organizational exposure far more efficiently than uniform coverage.

Measuring Human Risk Reduction Through Email Security Metrics

Completion rates are a compliance measure. They record that the employees sat through a module and say nothing about whether decisions improved afterward, which is why genuine measurement requires outcome-based metrics that correlate with real-world resilience.

Susceptibility trends over time matter more than any single click rate. A department that moved from a 32% failure rate to 11% over six months has demonstrably improved, while a department flat at 8% may have reached a static baseline that calls for a different intervention. Reporting speed, the lag between a suspicious message landing and an employee flagging it, reveals whether the workforce is participating actively or simply avoiding obvious lures.

The strongest programs correlate phishing simulation performance with overall human risk scores, tracking whether employees who improve in the inbox also improve against voice and SMS scenarios. When the same individuals who stop clicking phishing links also start questioning suspicious calls and flagging fraudulent texts, the organization has achieved behavioral change in place of better inbox hygiene alone.

Completion percentages tell leadership nothing about whether employee decisions have actually improved. Adaptive Security reports human risk in outcomes leadership can act on.

Explore the platform

How Adaptive Security Turns Email Security Dos and Don'ts Into Measurable Outcomes

Most organizations already know the email security dos and don'ts in this guide. What they lack is a way to prove those practices are being followed by the people who receive the messages. Adaptive Security closes that gap by connecting detection directly to behavior, so that every cyberattack reaching an inbox becomes both a remediation event and a lesson assigned to the employee it targeted.

Cloud Email Security layers onto Microsoft 365 and Google Workspace through API integration, with no MX record changes and no mail flow disruption, using behavioral signals, intent analysis, and large language model reasoning to catch AI-generated phishing and business email compromise that rule-based filters miss. Confirmed cyber threats are quarantined automatically across every attacked inbox, and each detection feeds the targeted employee's risk score. Phishing simulations extend the same intelligence outward across email, voice, and SMS, using OSINT-driven personalization that mirrors genuine reconnaissance over generic templates.

The governance and evidence layers complete the picture. AI Governance surfaces shadow AI and unsanctioned SaaS use, flags personal-account data exposure, and enforces policy through in-context coaching, addressing the internal exposure that inbound filtering cannot see. Compliance Training produces the auditable record that HIPAA, PCI DSS, and GDPR assessors ask for, tying delivered cybersecurity awareness training and completed phishing simulation to the specific clauses they satisfy.

Detection without behavior change leaves the same employees exposed to the next campaign. Adaptive Security connects every blocked cyberattack to training for the person it targeted.

Book a demo

Frequently Asked Questions About Email Security Dos and Don'ts

Should Multi-Factor Authentication Be Used on Every Email Account?

Yes, and email accounts deserve the strongest factor available because they control password resets for nearly every other service. Phishing-resistant methods are preferable wherever they can be deployed: hardware security keys built to the FIDO2 standard and biometric factors offer meaningfully stronger protection than SMS codes, which remain vulnerable to SIM-swapping. Authenticator applications with number matching add a further layer by requiring the user to confirm a displayed code rather than approving a blind prompt. Multi-factor authentication is not invulnerable, since adversary-in-the-middle cyberattacks can steal session tokens after authentication completes and bypass the second factor entirely, which is why it works best alongside cybersecurity awareness training that teaches employees to recognize the proxy login pages those cyberattacks depend on.

How Can Employees Recognize a Phishing Email?

Check several indicators before trusting any message instead of relying on a single tell. Expand the sender's actual address, because cyberattackers routinely spoof trusted display names while sending from unrelated domains. Hover over every link to preview the destination, treating mismatched, shortened, or subdomain-padded URLs as deception. Watch for urgency cues such as threatened account closure, pressure to act within hours, or unexpected payment requests. Inspect grammar and tone, remembering that generative AI now produces near-flawless spear phishing text and that tonal mismatch is now the more reliable signal. Treat unexpected attachments skeptically, with particular caution around QR codes, HTML files, and password-protected documents, all of which are chosen specifically to defeat automated scanning.

What Should an Employee Do Immediately After Clicking a Phishing Link?

Disconnect the device from the network first by disabling Wi-Fi and unplugging Ethernet, which severs any connection to the cyberattacker's infrastructure before lateral movement can begin. Do not enter credentials on any page that appears. Reset passwords for every potentially exposed account, starting with email and single sign-on, and enable multi-factor authentication anywhere it is not already active. Notify the IT or security team without delay, since response speed determines containment more than any other variable. Run a full malware scan, then inspect the mailbox for unauthorized forwarding rules, unfamiliar sent items, or changed MFA settings, each of which indicates the account was already taken over.

Should Organizations Implement DMARC, SPF, and DKIM?

Yes, because together they form a layered defense against the domain spoofing that underpins most impersonation-based phishing. SPF specifies which servers may send mail for the domain, DKIM attaches a cryptographic signature verifying message integrity, and DMARC instructs receiving servers how to handle messages that fail either check while progressing from monitoring through quarantine to full rejection. The critical point is enforcement: a published DMARC record at p=none provides visibility and no protection, so a domain sitting there is as impersonable as one with no record at all. Reaching p=reject shields partners and customers from impersonation, improves deliverability, and produces aggregate reports that show exactly who is sending mail using the domain.

How Does Generative AI Change Email Cyber Threats for Cyberattackers and Defenders?

Generative AI lets cyberattackers produce flawless, context-aware phishing at a scale that manual authorship never allowed, cloning executive writing styles, automating open-source reconnaissance, and generating thousands of personalized spear phishing variants from a handful of prompts. Harvard Business Review reported in 2024 that AI-generated phishing emails achieved a 54% click-through rate against 12% for manually written equivalents. Defenders gain from the same technology, using models that analyze language patterns, metadata anomalies, and sender behavior to catch messages that signature-based filtering cannot. AI-native cybersecurity awareness training platforms also use generative models to simulate emerging cyber threats including deepfake voice calls and AI-crafted smishing, giving employees controlled exposure before the genuine version arrives.

Every practice in this guide depends on employees acting correctly under pressure they cannot anticipate. Adaptive Security builds that reflex and reports on it.

Take a self-guided tour