What Is Email Security: The Complete Guide to Protecting Organizations from Phishing, BEC, and AI-Powered Threats

Email remains the primary channel through which cyberattackers breach organizations, intercept transactions, and exfiltrate sensitive data. The financial toll continues to accelerate as criminal tactics grow more targeted and technologically advanced. According to the FBI Internet Crime Complaint Center's 2025 Internet Crime Report, internet crime drove $20.877 billion in reported losses, a 26% jump over the prior year ($16.6 billion in 2024).

This guide covers:

• How the full scope of what is email security maps to every defensive layer, from connection filtering to post-delivery remediation;
• Why answering what is email security means confronting the protocol-level weaknesses that persist after four decades of incremental patches;
• The full spectrum of cyber threats targeting inboxes, including BEC, quishing, account takeover, and AI-generated attacks;
• How cybersecurity awareness training serves as an indispensable layer that technology alone cannot replace;
• A framework for evaluating email security solutions against real-world organizational risk.

Most organizations are training for attack vectors that cyberattackers bypass entirely. Adaptive Security builds multi-channel readiness across SMS, voice, and email.

Take a self-guided tour

What Is Email Security?

Understanding what is email security requires looking beyond any single technology. What is email security encompasses the technologies, policies, and practices that protect email accounts, communications, and data from unauthorized access, compromise, or loss. It spans inbound threat filtering that blocks phishing and malware before they reach the inbox, outbound data protection that prevents sensitive information from leaking, and account access controls that stop credential theft and impersonation. Effective email security depends on an interdependent combination of technology, administrative policy, and trained human judgment.

Core Definition and Objectives

Email security exists to preserve three foundational principles as they apply to organizational email systems. Confidentiality ensures that only authorized recipients can read message contents. Integrity guarantees the message was not altered in transit. Availability means the email system remains operational and accessible when the business needs it. When any one of these principles fails, the consequences are measurable and immediate.

According to Verizon's 2026 Data Breach Investigations Report, 62% of confirmed incidents involve a human element. This statistic underscores why what is email security cannot be answered by technology alone. The practice operates across three functional domains: inbound threat filtering examines every message entering the organization for malicious attachments, phishing URLs, and impersonation attempts; outbound data protection prevents sensitive information from leaving through email, whether by accident or through a compromised account; and account access control governs who can log into email systems, from what devices, and under what conditions.

These three domains work together because email cyber threats compound across them. A phishing email that bypasses inbound filters becomes a credential theft problem the moment an employee enters a password. A compromised account then weaponizes outbound email to target colleagues, partners, and customers from inside the organization's own trusted domain. Understanding what is email security means recognizing that it must function as a connected defense system spanning the full cyberattack chain.

The Three Pillars of Email Security: Technical Controls, Policies, and User Awareness

Answering what is email security requires examining three interdependent layers. Weakening any one of them creates gaps cyberattackers exploit.

The first pillar, technical controls, includes the infrastructure that processes, filters, and secures email traffic. Secure email gateways scan inbound and outbound messages for known threat signatures. Encryption protocols like TLS protect messages in transit. Authentication standards including SPF, DKIM, and DMARC verify sender identity and prevent domain spoofing. AI-driven detection engines identify novel phishing patterns that traditional rule-based filters miss. These automated defenses operate before any human sees a message.

The second pillar, administrative policies, defines the rules governing how email is used, retained, and investigated. An acceptable use policy establishes what employees can and cannot do with corporate email. A data retention policy specifies how long emails are stored and when they are permanently deleted. An incident response policy outlines exactly what happens when a phishing email is reported or a suspected compromise occurs: who investigates, what gets quarantined, how affected users are notified, and what remediation steps follow. Without these policies, even the best technical controls degrade into reactive noise.

The third pillar, user awareness, transforms employees from potential targets into active participants in the organization's email security defense. No filter catches every cyber threat. Cyberattackers continuously refine their tactics to bypass technical controls, which means the person reading the email is often the last line of defense. Effective cybersecurity awareness training programs use realistic phishing simulations to build recognition skills across the full spectrum of email cyber threats. Employees practice detecting credential harvesting, business email compromise, vendor impersonation, and AI-generated spear phishing in a safe environment before facing a real cyberattack.

As NIST computer scientist Julie Haney and University of Maryland Associate Professor Wayne Lutters concluded in their peer-reviewed analysis published in Computer (October 2020), compliance metrics do not tell the whole story and fail to measure the effectiveness of the program in a sustained change in employee attitudes and behaviors. When all three pillars operate together, the organization gains a defense architecture where technology blocks known cyber threats, policy governs behavior and response, and trained users catch what the other two layers miss.

What Email Security Protects: The Four Components at Risk

Exploring what is email security also means understanding what specific components of an email each layer of defense protects. Threat protection organizes around four distinct components, each representing a different attack surface requiring different detection logic.

The email body is the message content itself: the text a cyberattacker crafts to manipulate the recipient into taking action. Body-level cyber threats exploit psychological triggers including authority, scarcity, fear, and social proof. Detecting them requires natural language analysis that can identify manipulation patterns, rather than just keyword matching. Modern AI-generated phishing emails eliminate the spelling errors and awkward phrasing that used to betray scams, making body-content analysis increasingly dependent on behavioral signals.

Attachments carry embedded payloads: malware, ransomware, credential-stealing macros, and weaponized PDFs that execute code when opened. Attachment scanning examines file type, structure, and behavior, sandboxing suspicious files to observe what they do when executed, rather than relying solely on known malware signatures that cyberattackers can easily mutate.

URLs embedded in email bodies direct recipients to phishing sites designed to harvest credentials, deliver drive-by downloads, or initiate fraudulent transactions. URL defense requires real-time link scanning at the moment of click, domain reputation analysis, and machine learning models trained to identify brand impersonation patterns.

Sender identity represents the most difficult component to secure because it is fundamentally about trust. Cyberattackers spoof domains, compromise legitimate accounts, register lookalike domains, and exploit misconfigured authentication protocols. According to the FBI's 2025 Internet Crime Report (released April 2026), business email compromise accounted for $3.046 billion in losses across 24,768 incidents, averaging $123,000 per case. Defending sender identity requires DMARC enforcement, domain monitoring for newly registered lookalikes, and behavioral analysis that flags when a legitimate account suddenly exhibits unusual sending patterns.

Technical controls alone cannot stop a cyberattacker who has already compromised a legitimate account. Adaptive Security combines phishing simulations with behavioral analysis to detect and respond to compromised-account threats in real time.

Book a demo

Why Email Security Faces a Protocol-Level Challenge

The full scope of what is email security becomes clearer when organizations understand that email was designed in an era when every user on the network was assumed to be trustworthy. That foundational assumption continues to shape the cyber threats organizations face today, and no amount of layered technology fully erases it.

The Origins of SMTP and the Trust Assumption

SMTP was formalized in August 1982 through RFC 821, authored by Jon Postel at the Information Sciences Institute. The protocol was built for the ARPANET, a network connecting fewer than a thousand users across academic institutions, defense contractors, and government research labs. Every node on that network was operated by a known entity, and the concept of an anonymous, malicious third party intercepting or forging messages simply did not register as a design constraint.

SMTP shipped with zero authentication, no encryption, and no integrity verification. Any server could claim to be any sender, and the "MAIL FROM" command accepted whatever address the connecting host provided with no mechanism to verify it. Message contents traveled across the network in plaintext. Postel codified this philosophy in what became known as the Robustness Principle: be conservative in what you do, be liberal in what you accept from others. That principle made SMTP resilient across decades of infrastructure change, but it also baked a fatal security assumption into every email system that followed: accept anything, verify nothing.

How the Threat Landscape Outgrew the Protocol

The 1990s introduced spam that exploited SMTP's open-relay design. By the early 2000s, phishing had weaponized that same openness, with cyberattackers forging legitimate-looking sender addresses to trick recipients into disclosing credentials. The protocol had not changed; only the intent of its users had.

The 2010s brought business email compromise, cyberattacks that bypassed malware entirely and relied on pure social engineering conducted through email threads that appeared to come from CEOs, vendors, or legal counsel. These cyberattacks required no exploit code and no zero-day vulnerability. They used email exactly as it was designed to be used.

The 2020s introduced AI-generated attacks conducted across email, voice, and video channels simultaneously. According to the CrowdStrike 2026 Global Threat Report, the average adversary breakout time dropped to 29 minutes, with the fastest measured at just 27 seconds. An employee might receive an email from their CFO, followed by a voicemail in the same voice, then a calendar invite for a video call where every participant is a deepfake. Each channel reinforces the others, overwhelming the verification instincts that SMTP never required in the first place. Defending a 1982 protocol against adversaries armed with generative AI demands defenses that operate at layers the protocol never anticipated.

Cloud-Hosted vs. On-Premises Email: How Infrastructure Affects Email Security

A persistent misconception is that migrating email to Microsoft 365 or Google Workspace eliminates the protocol's foundational insecurity. Cloud-hosted email shifts operational burden off internal IT teams, but the shared responsibility model means the customer remains fully accountable for data, identities, user behavior, and the configuration of security controls that determine whether a well-crafted phishing email reaches an inbox.

On-premises Exchange servers offer total control over every security layer, but that control comes with the full burden of patching, perimeter defense, and continuous monitoring. A single missed Cumulative Update on an internet-facing Exchange server has been the entry point for some of the most damaging ransomware campaigns of the past five years. According to Sumsub's Identity Fraud Report 2024, deepfake fraud incidents grew 4 times year-over-year. Neither cloud nor on-premises infrastructure addresses the human-layer gap where these modern cyber threats concentrate.

The real question is whether the email environment, regardless of hosting model, is backed by a multi-layered defense strategy that includes realistic phishing simulation, employee cybersecurity awareness training against AI-powered social engineering, and automated remediation when a cyber threat bypasses native filters. That detection gap is a protocol problem, and closing it demands defenses that operate at the human layer, where SMTP's blind spots have always been most exposed.

Defending a protocol from 1982 with incremental patches leaves structural blind spots wide open. Adaptive Security builds defenses at the human layer where protocol-level gaps create the greatest exposure.

Take a self-guided tour

The Email Threat Landscape: Every Attack Type Organizations Face in Email Security

Email remains the most exploited attack surface in every organization, and the cyber threats targeting it have diversified well beyond simple spam. According to the FBI Internet Crime Complaint Center's 2025 Internet Crime Report, phishing and spoofing generated 191,561 complaints, the highest number of reports. Beneath that aggregate number sits a threat landscape far more varied than most security teams realize.

Phishing and Its Variants: Spear Phishing, Whaling, and Clone Phishing

Phishing is the broad-spectrum cyberattack where adversaries send deceptive emails designed to trick recipients into revealing credentials, downloading malware, or authorizing fraudulent transactions. What separates its variants is the level of targeting and the specific victim profile each exploits.

Spear phishing uses open-source intelligence scraped from LinkedIn profiles, company websites, social media, and breached databases to craft messages that reference real colleagues, ongoing projects, or internal tools. That context transforms a generic phishing lure into something genuinely difficult to question.

Whaling narrows the target set to executives and senior decision-makers. These cyberattacks impersonate legal counsel, board members, regulators, or fellow C-suite leaders, often referencing confidential-sounding matters that discourage the recipient from looping in the security team. Because senior leaders frequently operate outside standard approval workflows and resist mandatory training, whaling attacks carry a disproportionately high success rate relative to their volume.

Clone phishing takes a different approach: cyberattackers replicate a legitimate email the victim already received and replace the original link or attachment with a malicious version. The email looks identical because it was identical, minus one payload swap. Employees conditioned to scan for obvious typos or unfamiliar senders often miss clone attacks entirely.

Business Email Compromise, CEO Fraud, and Financial Social Engineering

Business email compromise (BEC) is the most financially devastating email threat category. Unlike credential-harvesting phishing, BEC aims directly at money movement, tricking employees into wiring funds to cyberattacker-controlled accounts. According to the FBI's 2025 Internet Crime Report (released April 2026), cyber-enabled fraud accounted for almost 85% of all losses reported to IC3, totaling $17.7 billion, and BEC remains the persistent risk at the costly center.

CEO fraud, the internal impersonation subset of BEC, occurs when a cyberattacker poses as a senior executive to pressure a finance or HR employee into an immediate wire transfer. The email typically arrives with a sense of manufactured crisis: a deal closing today, a regulatory deadline, a confidential acquisition that cannot be discussed through normal channels. The perceived career risk of questioning a CEO's urgent request often overrides security instincts.

The broader BEC umbrella also includes vendor and supplier impersonation. Cyberattackers compromise a legitimate supplier's email account and redirect real invoice payments to their own accounts. Because the email threads, formatting, and signatures all match previous correspondence, accounts payable teams routinely process these without flagging them.

Malware, Ransomware, and Malicious Attachments

Email is the primary delivery mechanism for malware at scale. According to Verizon's 2026 Data Breach Investigations Report, 96% of ransomware victims were small and medium-sized businesses, as SMBs present unpatched devices, compromised credentials, and limited recovery capabilities. Ransomware variants arrive as weaponized attachments or links that, once opened, encrypt network shares and demand ransoms.

Information stealers represent a parallel and equally dangerous category. Rather than locking files like ransomware, these tools silently exfiltrate credentials, browser sessions, cryptocurrency wallets, and VPN tokens. Cyberattackers then sell that data or use it for lateral movement and follow-on BEC campaigns. An employee who opens one malicious attachment can unknowingly hand cyberattackers access to every system their credentials touch.

According to Verizon's 2026 Data Breach Investigations Report, 69% of victims refused to pay ransoms in 2025, up from 65% the prior year, and the median payment fell to $139,875 from $150,000. The attachment formats themselves reflect cyberattacker adaptation: weaponized Microsoft Office documents still dominate, but JavaScript files, Visual Basic scripts, and booby-trapped PDFs have grown sharply as organizations improved macro-blocking defenses.

Emerging and Advanced Threats: Quishing, Account Takeover, Conversation Hijacking, and Lateral Phishing

Quishing, or QR code phishing, has expanded because it sidesteps a core defensive assumption. Traditional email security scans URLs in message bodies, but QR codes render links as images that URL scanners cannot parse. An employee receives what looks like a routine multifactor authentication re-enrollment notice with a QR code, scans it on their phone, and lands on a credential-harvesting page their corporate email filter never saw.

Account takeover turns a legitimate, previously trusted account into an attack platform. Once cyberattackers capture credentials through phishing, infostealer malware, or credential-stuffing, they access the victim's real inbox and send phishing emails to internal colleagues, clients, and partners from a verified corporate address. These messages bypass reputation checks and carry the full trust weight of the compromised identity.

Conversation hijacking takes account takeover further by inserting malicious content into active, legitimate email threads. Rather than starting a new suspicious message, the cyberattacker replies to an ongoing discussion about a real project, attaching a "revised contract" or "updated invoice" that delivers malware. The cyberattack exploits established context instead of manufacturing it from scratch.

Lateral phishing chains these compromises horizontally. A cyberattacker who compromises one account uses it to phish five colleagues; one of those five clicks, and the cyberattacker now controls two accounts, using each to phish five more. Within hours, a single successful email can spawn dozens of internal compromises, all propagating through trusted internal addresses that external reputation filters never flag. This is why an organization's approach to phishing simulations must test internal-to-internal cyber threats, rather than just inbound email from outside the perimeter.

A static defense model cannot keep pace with cyber threats that evolve weekly and propagate laterally through compromised accounts. Adaptive Security continuously adapts phishing simulations and training to match the tactics organizations actually face.

Book a demo

How Email Security Works: The Multi-Layered Defense Architecture

Modern email security operates as a defense-in-depth architecture spanning five distinct layers, from the network perimeter to the inbox itself. Organizations deploy connection-level filtering to block traffic from known-malicious IP addresses before any message content is inspected. They enforce protocol-level authentication through SPF, DKIM, and DMARC to reject spoofed sender identities at the SMTP handshake. Content filtering engines and attachment sandboxing catch what passes the first two barriers. Post-delivery remediation removes cyber threats that users have already received, because no single layer catches everything.

The Multi-Layered Defense Model Explained

Every email that reaches a user's inbox has passed through a series of defensive checkpoints. Each layer addresses a different failure mode in the email delivery chain, and skipping any one of them creates a gap cyberattackers will find and exploit.

Connection-level filtering is the outermost perimeter. Before a sending server can transmit message content, the receiving infrastructure checks its IP address against real-time blocklists, evaluates its sending reputation, and enforces rate limits. If the IP belongs to a known spam operation or exhibits suspicious sending patterns, the connection is dropped at the TCP level. This layer eliminates the highest volume of low-sophistication cyber threats before they consume downstream processing resources.

Protocol-level authentication verifies who actually sent the message. Sender Policy Framework (SPF) specifies which servers are authorized to send email for a given domain. DomainKeys Identified Mail (DKIM) attaches a cryptographic signature that proves the message was not altered in transit. Domain-based Message Authentication, Reporting, and Conformance (DMARC) ties them together by telling receiving servers what to do when neither check passes: monitor, quarantine, or reject. A domain without DMARC at enforcement is a domain anyone can impersonate.

Content filtering inspects what the message actually contains. Bayesian spam classifiers analyze word frequency, header anomalies, and structural patterns against statistical models. URL rewriting engines replace embedded links with redirect URLs that check the destination in real time when clicked. Anti-malware engines scan for known signatures and heuristic anomalies. This is the layer where AI-powered detection has made the biggest impact against generative AI phishing that reads like authentic business communication.

Attachment analysis handles the most dangerous payloads. Static analysis inspects file types, structures, and metadata without executing the file. Dynamic analysis, or sandboxing, detonates the attachment in an isolated virtual environment, observes its behavior, and blocks it if it attempts registry modifications, outbound connections, or process injection. Sophisticated cyberattackers now delay malicious behavior inside sandboxes, which is why modern sandboxes emulate user interaction and run extended observation windows.

Post-delivery remediation acknowledges that some cyber threats will always get through. Security teams need the ability to reach into user inboxes and remove malicious messages before employees act on them. This includes quarantine management, automated retroactive threat hunting that searches all mailboxes for messages matching newly discovered indicators of compromise, and orchestration workflows that trigger targeted cybersecurity awareness training for any employee who interacted with a now-confirmed cyber threat.

According to the World Economic Forum's 2026 Global Cybersecurity Outlook, 52% of organizations indicate that board members receive regular cybersecurity updates, and 48% report that board members are actively engaged with cybersecurity issues. The report emphasizes that board members hold personal liability in the event of cyber breaches, with 30% of board members in high-resilience organizations holding liability compared to only 9% in low-resilience organizations. This governance pressure is one reason organizations increasingly demand visibility into whether their multi-layered architecture actually stops cyber threats or merely generates compliance checkboxes.

Secure Email Gateways vs. API-Based Email Security: How They Compare

The architecture choice between Secure Email Gateways (SEGs) and API-based email security determines where inspection happens, how fast cyber threats are blocked, and what the security team must manage.

Secure Email Gateways sit inline with mail delivery. Organizations reconfigure their domain's MX records to route all inbound email through the gateway, which inspects every message before forwarding clean traffic to the mail server. The defining advantage is pre-delivery blocking: cyber threats never touch the inbox. The tradeoffs are significant. If the gateway goes down, mail flow stops. Deployment requires DNS changes, often physical or virtual appliances, and ongoing configuration overhead. SEGs can break SPF and DKIM alignment if not tuned carefully. Critically, SEGs are blind to internal email; a compromised account sending phishing to colleagues inside the organization passes laterally without ever touching the gateway.

API-based email security takes the opposite approach. Instead of rerouting mail, it connects to Microsoft 365 or Google Workspace through native API integrations and scans messages after delivery. Deployment takes minutes with no MX record changes and no mail-flow dependency. Because the tool operates inside the mailbox, it sees internal, inbound, and outbound traffic equally, closing the lateral phishing blind spot that SEGs cannot address. The tradeoff is that cyber threats are detected and removed after delivery, meaning a user might briefly see a malicious message before it is pulled. Detection relies on machine learning models that analyze sender behavior, communication patterns, and message content across the entire tenant, often surfacing cyber threats that signature-based SEG rules miss.

The most resilient organizations run both: a SEG for pre-delivery filtering at the perimeter and an API-based tool for post-delivery detection, internal visibility, and rapid remediation. For cloud-native organizations running entirely on Microsoft 365 or Google Workspace, API-based email security often provides sufficient protection without the operational overhead of managing a gateway, especially when paired with properly enforced DMARC at the authentication layer.

Filtering, Detection, and Threat Remediation: From Inbound to Response

When a malicious email arrives, the defensive architecture activates across three sequential phases. Understanding this pipeline reveals where security controls succeed, where they fail, and why employee reporting is an essential detection signal rather than a backup plan.

Filtering blocks known-bad senders at the connection and authentication layers. If the sending IP appears on a reputation blocklist, the connection terminates before the message is transmitted. If SPF, DKIM, and DMARC checks fail and the domain owner has published an enforcement policy, the receiving server rejects the message at the SMTP level. These first-phase controls are fast, rules-based, and eliminate the highest volume of low-sophistication cyberattacks.

Detection activates when a message passes filtering and reaches the content inspection engines. Bayesian classifiers score the message for spam probability. URL rewriting engines check every embedded link against threat intelligence feeds. Anti-malware engines scan attachments statically and detonate suspicious files in a sandbox. AI-based detection models analyze the message's linguistic patterns against known social engineering templates, looking for the conversational nuance of modern AI-generated phishing that mimics authentic executive communication.

Threat remediation begins the moment a message is confirmed malicious. The security platform quarantines the message, removing it from the user's inbox. Automated threat hunting then searches all mailboxes across the organization for messages sharing the same sender, subject patterns, or attachment hashes, removing every instance. If any user opened or interacted with the message, the system triggers targeted CAT training specific to the cyber threat type they encountered.

According to Verizon's 2026 Data Breach Investigations Report, stolen credentials were involved in 13% of all breaches. The phish reporting loop closes the detection gap that automated tools cannot bridge. When employees report suspicious messages, each report feeds into the detection engine's CAT training data, improving classifier accuracy against new attack variants. Organizations that close this loop, supported by automated phish triage that classifies and remediates reported cyber threats at scale, see detection times drop and false-negative rates decline as the system learns from the patterns their workforce surfaces.

Detection gaps between pre-delivery and post-delivery layers give cyberattackers a window of opportunity to reach employees. Adaptive Security closes that window with integrated phishing simulation, automated triage, and real-time remediation.

Explore the platform

Email Security Authentication Protocols: SPF, DKIM, and DMARC Explained

Email authentication protocols are DNS-based standards that verify whether an incoming email genuinely originates from the domain it claims to represent. SPF, DKIM, and DMARC work together as a chain. SPF authorizes which servers may send mail for a domain. DKIM cryptographically signs each message to prove it has not been tampered with. DMARC tells receiving servers what to do when either check fails. Without all three deployed in tandem, any domain can be impersonated in a phishing attack without the recipient's mail server detecting the forgery. DMARC is the only protocol in the stack that actually prevents spoofed emails from reaching inboxes.

As of early 2026, only 30.4% of domains have adopted DMARC at any level, and a mere 12.8% enforce a policy that blocks spoofed messages, according to a DMARCguard analysis of 5.5 million domains. That leaves nearly 70% of domains vulnerable to direct impersonation. This is the attack surface that fuels business email compromise. The gap between deploying authentication and enforcing it is where cyberattackers operate.

How SPF Prevents Domain Spoofing in Email Security

Sender Policy Framework (SPF) is the simplest of the three protocols and the most widely adopted. Fifty-six percent of domains publish an SPF record. An SPF record is a DNS TXT record that lists every IP address and mail server authorized to send email on behalf of a domain. When an email arrives, the receiving mail server queries the sending domain's SPF record and checks whether the connecting IP address matches the authorized list. A match produces an SPF pass, and a mismatch produces a fail.

SPF works at the envelope level, the Return-Path header that users never see, rather than the From address displayed in the inbox. This is its fundamental limitation. A cyberattacker can send a message that passes SPF checks by using a domain they control in the Return-Path while still displaying the target CEO's name and email address in the From field. The recipient sees a legitimate-looking sender, the mail server sees an SPF pass, and the target domain was never technically spoofed at the envelope layer.

SPF also breaks on email forwarding. When a message passes through an intermediate mail server such as a mailing list or a third-party relay, the original SPF check against the sender's IP address becomes irrelevant. The forwarding server is now the connecting host, and unless it is listed in the original domain's SPF record, the check fails. There is no graceful workaround built into the protocol.

The 10-DNS-lookup limit defined in RFC 7208 creates another failure mode. Every include: mechanism in an SPF record triggers a DNS query, and after ten lookups, the specification mandates a permanent error. A typical organization using Google Workspace, Mailchimp, HubSpot, Zendesk, and Salesforce can burn through six or seven lookups before any custom services are added. DMARCguard's 2026 scan found that 4.8% of all SPF-enabled domains already exceed this limit, causing their SPF records to return PermError, which means they fail every authentication check for every message.

How DKIM Verifies Message Integrity for Email Security

DomainKeys Identified Mail (DKIM) addresses what SPF cannot: proving that a specific message has not been altered in transit and that it genuinely originated from the signing domain. DKIM works through asymmetric cryptography. The sending mail server generates a cryptographic hash of the message body and selected headers, then encrypts that hash with a private key. The resulting digital signature is added to the email as a DKIM-Signature header. The corresponding public key is published in DNS at a selector-specific subdomain.

When the receiving server processes the message, it retrieves the public key from DNS, decrypts the signature, and computes its own hash of the same message components. If the two hashes match, DKIM passes. This verifies two things: the message was not modified after it left the sending server, and the domain that signed it took responsibility for its content.

DKIM adoption lags significantly behind SPF. Only 22.7% of domains have detectable DKIM records, according to the DMARCguard scan. The reason is complexity. DKIM requires key pair generation, DNS publication of the public key, mail server configuration to sign outbound messages, and periodic key rotation, substantially more work than publishing a single SPF TXT record.

Critically, DKIM alone does not authenticate the sender. A message can pass DKIM verification and still display a completely unrelated From address. The DKIM signature proves the signing domain took responsibility, but if that signing domain is not aligned with the domain the recipient sees in their inbox, the check provides no protection against impersonation. This is why DKIM must be paired with DMARC alignment to become a meaningful anti-spoofing control within a broader email security strategy.

How DMARC Ties SPF and DKIM Together for Email Security

Domain-based Message Authentication, Reporting, and Conformance (DMARC) is the policy layer that transforms SPF and DKIM from diagnostic signals into enforceable security controls. DMARC answers two questions that neither SPF nor DKIM can answer alone: which domain should the recipient believe, and what should happen to email that fails authentication?

DMARC introduces the concept of alignment. For DMARC to pass, at least one of SPF or DKIM must produce a passing result, and the domain in that passing result must match the domain in the From header that the recipient sees. Without alignment, a cyberattacker can pass SPF with a throwaway domain and still display a trusted brand in the From field. DMARC closes that gap by requiring the authenticated domain and the visible domain to be the same.

The DMARC record is published as a DNS TXT record at _dmarc.yourdomain.com and contains a policy tag (p=) that instructs receiving servers how to handle messages that fail alignment checks. The three policy levels map to a deliberate progression. p=none is monitoring mode, where authentication results are reported but no action is taken. p=quarantine directs receiving servers to route failing messages to the spam folder. p=reject instructs the receiving server to discard the message entirely. Only p=reject actually prevents domain spoofing from reaching recipients.

The progression from p=none to p=reject is where most organizations stall. Across the 5.5 million domains scanned in early 2026, 57.9% of DMARC-enabled domains remain at p=none. Moving to p=reject requires confidence that every legitimate sending source, from marketing platforms to support ticketing systems, is properly authenticated in SPF or DKIM. Missing even one legitimate source results in rejected mail, which is why many organizations hesitate.

DMARC also introduces reporting. The rua tag specifies an email address where receiving servers send daily aggregate reports listing every authentication result. The ruf tag enables forensic reporting, which sends full copies of individual failing messages for detailed analysis. Aggregate reporting adoption is relatively strong at 53.5% of DMARC-enabled domains, while forensic reporting is far rarer due to privacy concerns and data volume.

Since Google and Yahoo mandated DMARC for bulk senders in February 2024, Google has reported a 65% reduction in unauthenticated messages reaching Gmail inboxes. That reduction represents billions of spoofed messages blocked before a human ever had the chance to click. Yet authentication protocols are only the first checkpoint. They cannot stop an employee from trusting a phishing message sent from a compromised but authenticated account, or from a lookalike domain with its own valid SPF, DKIM, and DMARC records.

Most organizations deploy SPF, DKIM, and DMARC but stop at p=none, leaving their domains spoofable. Adaptive Security closes the enforcement gap and monitors for lookalike domains that authentication alone misses.

Explore the platform

Email Security Encryption: How It Protects Data in Transit and at Rest

Email encryption converts plaintext email content into ciphertext using cryptographic algorithms so only an authorized recipient with the correct decryption key can read it. It protects data confidentiality while messages travel between mail servers and, depending on the method, while stored on servers or end-user devices. The two dominant approaches are Transport Layer Security (TLS), which encrypts the connection between mail servers, and end-to-end encryption protocols like PGP and S/MIME, which encrypt the message content itself from sender to recipient. Understanding what encryption contributes to what is email security requires acknowledging what it does not do: encryption does not protect against the human-layer attacks that drive the majority of breaches.

TLS: Transport Layer Security for Email in Transit

TLS is the most widely deployed email encryption protocol. It establishes an encrypted tunnel between two mail servers when a message is being transmitted. When a Gmail user sends a message to an Outlook recipient, TLS encrypts the connection so anyone intercepting network traffic between Google's and Microsoft's servers sees only indecipherable noise.

The critical distinction is that TLS encrypts the connection, not the message. Once the email arrives at the recipient's mail server, TLS's job is done. The message sits on that server, and on the recipient's device, in unencrypted, readable form. Any system administrator with server access, any cloud provider employee with the right permissions, or any cyberattacker who compromises that server can read every word.

TLS is also opportunistic by default. When two mail servers negotiate a connection, they attempt to establish TLS. If the receiving server does not support it, the sending server typically falls back to transmitting the message in plaintext to avoid delivery failure. An email sent securely to one recipient may traverse the internet completely exposed to the next. According to Google's Transparency Report, while the overwhelming majority of messages between major providers now use TLS, gaps remain with smaller domains, legacy on-premises servers, and organizations in regions with less mature internet infrastructure. A single unencrypted hop in the delivery chain breaks confidentiality for the entire message.

End-to-End Encryption: PGP and S/MIME Explained

End-to-end encryption solves TLS's fundamental limitation by encrypting the message content itself rather than just the transmission channel. With true end-to-end encryption, the email is encrypted on the sender's device before it ever leaves their machine and remains encrypted until the recipient decrypts it on their device. No intermediate server, administrator, or cloud provider can read the content.

Pretty Good Privacy (PGP) uses a decentralized trust model called the web of trust. Users generate their own public-private key pairs and manually verify each other's keys, often through in-person key-signing events or by checking key fingerprints over a secondary channel. PGP places trust decisions entirely in the hands of individual users rather than any central authority.

S/MIME, by contrast, relies on a hierarchical certificate authority (CA) model. Certificates are issued by trusted CAs and are tied to verified identities. Major email clients including Outlook and Apple Mail support S/MIME natively, making it the more enterprise-friendly option on paper.

Both protocols also support digital signatures, which cryptographically verify that the email genuinely came from the claimed sender and was not altered in transit. In practice, both PGP and S/MIME face steep adoption barriers. Key management remains the central friction point. PGP requires users to generate, store, and manage key pairs, and losing a private key means losing access to every encrypted message ever received. S/MIME requires purchasing and renewing certificates from a CA, a process that introduces cost and administrative overhead per user. Both protocols require recipients to have compatible software configured, a coordination problem that breaks down as soon as an organization emails someone outside its perimeter. Despite decades of availability, end-to-end email encryption remains a niche tool used primarily by journalists, security researchers, and organizations handling regulated data.

What Encryption Can and Cannot Protect Against in Email Security

Encryption serves two functions exceptionally well within email security. It protects message confidentiality during transmission, and it verifies sender identity and message integrity when paired with digital signatures. These are valuable properties for organizations handling sensitive financial data, protected health information under HIPAA, or personally identifiable information subject to GDPR.

What encryption cannot do is address the cyber threats that account for the vast majority of email-initiated breaches. Encryption does not prevent an employee from entering credentials into a phishing site. It does not stop a compromised account from sending fraudulent wire transfer instructions to an accounts payable team. It does not detect a deepfake video call preceded by a credential-harvesting email.

According to the National Cybersecurity Alliance's 2025-2026 Oh Behave! The Annual Cybersecurity Attitudes and Behaviors Report, 52% of employed participants reported they have not received any training on the security or privacy risks of AI tools, despite 65% now using AI and 43% admitting to sharing sensitive work information with AI tools. This gap concentrates risk precisely where encryption provides no coverage.

Encryption protects the channel. Cybersecurity awareness training protects the human making decisions inside that channel. Both are necessary components of what is email security, but neither substitutes for the other. Organizations that invest heavily in encryption while treating employee behavior as a secondary concern create an asymmetry that cyberattackers exploit with increasing precision.

Encryption protects the channel but leaves the human decision-maker completely exposed to social engineering. Adaptive Security builds the behavioral defenses that encryption cannot provide through adaptive phishing simulations and targeted training.

Take a self-guided tour

The Human Layer: Why Email Security Fails Without Cybersecurity Awareness Training

Technical controls filter traffic, authenticate senders, and encrypt payloads. Yet the decisive moment in most email cyberattacks occurs when a human being decides whether to click a link, open an attachment, or wire funds. That decision point is where the majority of breaches originate, and it is the one layer that no gateway, protocol, or encryption standard can fully control.

Why Technical Controls Alone Are Insufficient for Email Security

Every technical layer in the email security stack has a documented bypass. Connection-level filtering misses cyberattackers operating from clean IP addresses with established reputations. SPF passes when the cyberattacker controls the envelope domain. DKIM passes when the cyberattacker signs from their own infrastructure. DMARC passes when the cyberattacker registers a lookalike domain with properly configured authentication. Content filters miss AI-generated phishing that contains no signature patterns. Sandboxes miss payloads that delay execution. Post-delivery remediation arrives after the employee has already clicked.

According to the FBI's Internet Crime Report 2025, BEC losses reached $3.04 billion in the U.S. alone, virtually all routed through manager-level approvers. These were not technical failures. The emails often came from authenticated, uncompromised accounts or lookalike domains with valid SPF, DKIM, and DMARC records. The cyber threat passed every automated checkpoint because it was not a technical anomaly. It was a social engineering scenario that required human judgment to recognize and reject.

The belief that technology will eventually close this gap is unsupported by the evidence. Cyberattackers adapt their tactics in direct response to defensive technology. Each new filtering capability creates an incentive to develop a bypass. The result is an arms race where technical defenses chase the last cyberattack while cyberattackers refine the next one. Human judgment, when properly trained, operates on a different detection model: pattern recognition informed by contextual understanding of the organization, its relationships, and its normal communication patterns.

How Cybersecurity Awareness Training Programs Close the Gap

A cybersecurity awareness training program builds the cognitive skills that technical controls cannot replicate. Effective CAT does not rely on annual slide decks or multiple-choice quizzes. It uses realistic phishing simulations that mirror the specific cyber threats the organization faces, from BEC scenarios targeting finance teams to spear phishing campaigns referencing real projects and colleagues.

According to Sumsub's 2025-2026 Identity Fraud Report, deepfake attacks increased 2,100% globally, with sophisticated fraud surging 180% year-over-year including deepfakes, synthetics, and telemetry tampering. A cybersecurity awareness training program must now prepare employees to recognize not just text-based deception but voice and video impersonation that arrives through or is coordinated with email channels. This requires continuous, scenario-based CAT that evolves alongside the cyber threat landscape rather than repeating the same static content year after year.

The most effective programs tie simulation results directly to individual risk profiles. An employee who consistently identifies phishing attempts receives different CAT content than one who repeatedly clicks. Remedial CAT is triggered immediately when an employee interacts with a simulated cyber threat, delivered in the moment when the lesson is most likely to stick. This is the model a modern cybersecurity awareness training platform provides: continuous assessment, individualized learning paths, and measurable behavior change rather than checkbox compliance.

Measuring What Matters: Behavior Change vs. Completion Rates

The traditional approach to measuring cybersecurity awareness training focuses on completion rates: what percentage of employees finished their assigned modules. This metric tells an organization nothing about whether its workforce is actually more difficult to phish. An employee can complete every module and still click on a well-crafted BEC email the following morning.

Meaningful measurement focuses on behavior change over time. Phish click rates, reporting rates, and time-to-report are the metrics that indicate whether a cybersecurity awareness training program is reducing organizational risk. A declining click rate across successive simulations demonstrates that employees are applying recognition skills to new scenarios. An increasing reporting rate shows that employees are actively participating in the detection loop rather than passively consuming content. A decreasing time-to-report indicates that the instinct to flag suspicious email is becoming automatic.

Organizations that shift their measurement framework from completion to behavior gain a clearer picture of their actual email security posture. They can identify which departments carry the highest human risk, which cyber threat types are most likely to succeed against their workforce, and where CAT investments are generating measurable risk reduction versus wasted effort. A cybersecurity awareness training platform that surfaces these behavioral analytics transforms training from a compliance obligation into a strategic risk reduction tool.

Completion metrics create a false sense of security while click rates tell the real story of organizational risk. Adaptive Security measures behavior change, not checkboxes, to deliver measurable risk reduction.

Book a demo

How Adaptive Security Approaches Email Security

Defining what is email security in practice requires a platform that treats every layer, from authentication to human behavior, as an integrated system rather than a collection of disconnected tools. Adaptive Security provides that integration by combining phishing simulation, behavioral analysis, automated triage, and targeted CAT into a single platform designed to reduce measurable human risk.

Adaptive Security operates on a simple principle: the only metric that matters is whether the organization is demonstrably harder to phish over time. Every phishing simulation, every training assignment, and every triage decision feeds into a behavioral risk engine that tracks how employees actually respond to cyber threats, not whether they completed a module. This approach treats cybersecurity awareness training as a continuous security control rather than an annual compliance event, embedding it directly into the email security workflow where risk actually materializes.

The platform connects automated phish triage with real-time simulation adaptation. When employees report suspicious emails, the triage engine classifies and remediates those reports at scale while simultaneously feeding intelligence back into the simulation engine. If a new BEC pattern is emerging against the organization, the simulation library updates to test for that specific pattern. If a particular department shows elevated click rates, CAT content adjusts to address the specific cyber threats that department faces. This closed-loop system ensures that what is email security is defined by actual risk data rather than assumptions within the organization.

Fragmented tools create blind spots between detection, training, and remediation that cyberattackers exploit daily. Adaptive Security unifies phishing simulation, triage, and training into a single outcome-focused platform.

Explore the platform

Frequently Asked Questions About Email Security

What Is the Difference Between a Secure Email Gateway and API-Based Email Security?

A secure email gateway (SEG) sits inline with mail delivery, inspecting every message before it reaches the inbox by routing traffic through a dedicated appliance or cloud service. API-based email security connects directly to Microsoft 365 or Google Workspace through native integrations and scans messages after delivery. SEGs block cyber threats pre-delivery but are blind to internal lateral phishing. API-based tools see all traffic, including internal, but detect and remove cyber threats after they arrive. Many organizations deploy both architectures to achieve complete visibility.

What Is the Role of Cybersecurity Awareness Training in Email Security?

Cybersecurity awareness training builds the human detection capability that technical controls cannot provide. Because cyberattackers continuously develop tactics that bypass automated filtering, the employee reading the email often serves as the final decision point. A cybersecurity awareness training program uses realistic phishing simulations, targeted remediation, and continuous assessment to improve recognition skills across the full spectrum of email cyber threats, from credential harvesting to business email compromise.

What Is DMARC and Why Does It Matter for Email Security?

DMARC (Domain-based Message Authentication, Reporting, and Conformance) is a DNS-based authentication protocol that ties SPF and DKIM together by requiring alignment between the authenticated domain and the From address displayed to the recipient. DMARC also specifies a policy, typically p=none, p=quarantine, or p=reject, that tells receiving servers what to do when authentication fails. Only p=reject actually prevents domain spoofing, and most organizations that deploy DMARC fail to reach enforcement, leaving their domains vulnerable to impersonation.

What Is the Biggest Limitation of Email Encryption?

Email encryption, whether TLS or end-to-end protocols like PGP and S/MIME, protects message confidentiality and integrity during transmission. It does not protect against the human-layer cyber threats that cause the majority of email-initiated breaches. Encryption cannot prevent an employee from entering credentials into a phishing site, approving a fraudulent wire transfer, or sharing sensitive information with an AI tool. It protects the channel, not the decisions made within it.

What Is the Most Costly Email Threat?

Business email compromise (BEC) is the most financially damaging email threat category. According to the FBI's 2025 Internet Crime Report, BEC accounted for $3.046 billion in losses across 24,768 incidents in the U.S., averaging $123,000 per case. BEC bypasses technical controls by exploiting human trust and organizational hierarchy, often using authenticated or lookalike domains that pass standard email authentication checks.

Key Takeaways

• Understanding what is email security requires looking beyond any single technology to a connected defense system spanning inbound filtering, outbound protection, and account access control.
• Answering what is email security means confronting SMTP's foundational trust assumption, which no amount of incremental patching has fully resolved.
• The email threat landscape extends well beyond basic phishing to include BEC, quishing, account takeover, conversation hijacking, and AI-generated multi-channel attacks.
• Authentication protocols (SPF, DKIM, DMARC) prevent domain spoofing but cannot stop cyber threats from authenticated or lookalike domains.
• Encryption protects data in transit and at rest but provides no defense against the human-layer attacks that drive the majority of breaches.
• A cybersecurity awareness training program closes the detection gap that every technical layer in the email security stack leaves open.
• Effective cybersecurity awareness training measures behavior change, such as declining click rates and increasing reporting rates, rather than module completion percentages.
• A cybersecurity awareness training platform transforms training from a compliance checkbox into a continuous, data-driven risk reduction control.
• Modern email security demands both pre-delivery filtering through secure email gateways and post-delivery detection through API-based tools.
• Defining what is email security for any organization ultimately depends on whether the defense architecture measurably reduces the risk of a successful cyberattack.

Knowing what email security requires and actually building it are two different challenges. Adaptive Security helps organizations close the gap between theory and measurable risk reduction.

Book a demo