Connect with us

Hi, what are you looking for?


Email Security

State of Email Security: What Can Stop Email Threats?

Neither Current Technology Nor Security Awareness Training Will Stop Email Threats

Neither Current Technology Nor Security Awareness Training Will Stop Email Threats

A survey of 295 professionals — mostly but not entirely IT professionals — has found that 85% of respondents see email threats bypass email security controls and make it into the inbox; 40% see weekly threats; and 20% have to take significant remediation action on a weekly basis. 

Email security firm GreatHorn wanted to examine the state of email security today, nearly fifty years after email was first developed. Its findings (PDF) will not surprise security professionals. Breach analyses regularly conclude that more than 90% of all breaches start with an email attack. Indeed, the GreatHorn research shows that the majority (54.4%) of corporate security leaders (that is, those who hold the CISO role) consider email security to be a top 3 security priority.

What is surprising is not that email security is failing (almost half — 46.1% — of all respondents said they were less than ‘satisfied’ with their current email security solution), but the discrepancy in threat perception between the security professional respondents (comprising 61% of the sample) and the non-security respondents (the laypeople, comprising 39% of the sample).

“Sixty-six percent of all the people we interviewed said the only threat they saw in their inbox was spam,” GreatHorn’s CEO and co-founder Kevin O’Brien told SecurityWeek. “I suspect there is a little bit of a confluence of different things in this figure, and that when they say ‘spam’, they don’t only mean unsolicited marketing emails. Nevertheless, it is a dismissal of the severity of the risk that email poses.”

This figure changes dramatically when asked of the security professionals among the respondents. “When you narrow the interview stats to security professionals, less than 16% said that spam was the main threat they faced,” he continued. “So, you have 85% of all security teams saying that there is a wide range of different kinds of threats that come in every single day via email — but to the lay user, the only thing that ever goes wrong is that you get some email you don’t want.”

O’Brien also quoted statistics from Gartner email specialist Neil Wynne: “The email open rate for the average white-collar professional within the bounds of their work email is 100%,” said O’Brien. “Whether or not you take any action in response to it, you will open the email.”

Advertisement. Scroll to continue reading.

It is true that you can open a malicious email and take no action whatsoever and you will remain safe. But that clearly doesn’t happen. GreatHorn’s figures show that 20% of the security professional respondents are forced into direct remediation from email threats (such as suspending compromised accounts, PowerShell scripts, resetting compromised third-party accounts, etc).

The implication, at a simplistic level, is that the average non-security member of staff is highly likely to open all emails; is not likely to expect anything other than spam (31% of the laypeople respondents said they never saw any email threats other than spam); and clearly — from empirical proof — will too often click on a malicious link or open a weaponized attachment.

Asked if a further implication from these figures is that security awareness training is failing, O’Brien said, “Yes.” There are qualifications to this response, because phish training companies’ built-in metrics clearly demonstrate an improvement in the click-thru rates for users trained with their systems. Reductions in successful phishing from a 30% success rate to just 10% is not uncommon.

But, said O’Brien, “Verizon has reported that one in 25 people click on any given phishing attack.” This suggests that for every 100 members of staff targeted by a phishing email, four will become victims — and only one is necessary for a breach to occur.

The difficulty is the nature of modern email attacks. Many involve some form of impersonation, including BEC attacks, business spoofing attacks, and pure social engineering attacks from a colleague whose credentials have been acquired by the attacker. “You cannot train people to have awareness of an email threat when information about that threat is not visible to the user. There is very little functional way to train a user to differentiate between an email from a colleague and an email from someone who has stolen the colleague’s credentials. So, we have a security awareness market that has used marketing to say that email security is an awareness problem, a people problem, and that you can train your way out of it. You cannot.”

He added, “The reason that security awareness training companies are successful is because awareness training represents a tick in a compliance box that clears a company of gross negligence in the event they suffer a data breach.” So, despite the fact it isn’t really effective, you still need to do it.

GreatHorn’s own view of the problem is that the solution must come from not just technology, nor simply people, but from using technology against the social engineering aspect of the threat — that is, the content as well as the mechanics of the email.

Belmont, Mass-based GreatHorn announced a $6.3 million Series A funding round led by Techstars Venture Capital Fund and .406 Ventures in June 2017. It brings machine-learning technology to the continuing threat and problem of targeted spear phishing and the related BEC threat — the latter of which, according to the FBI in May 2016, is responsible for losses “now totaling over $3 billion.”

Written By

Kevin Townsend is a Senior Contributor at SecurityWeek. He has been writing about high tech issues since before the birth of Microsoft. For the last 15 years he has specialized in information security; and has had many thousands of articles published in dozens of different magazines – from The Times and the Financial Times to current and long-gone computer magazines.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join security experts as they discuss ZTNA’s untapped potential to both reduce cyber risk and empower the business.


Join Microsoft and Finite State for a webinar that will introduce a new strategy for securing the software supply chain.


Expert Insights

Related Content

Cloud Security

Cloud security researcher warns that stolen Microsoft signing key was more powerful and not limited to and Exchange Online.

Application Security

Fortinet on Monday issued an emergency patch to cover a severe vulnerability in its FortiOS SSL-VPN product, warning that hackers have already exploited the...

Cloud Security

Microsoft and Proofpoint are warning organizations that use cloud services about a recent consent phishing attack that abused Microsoft’s ‘verified publisher’ status.


Government agencies in the United States have made progress in the implementation of the DMARC standard in response to a Department of Homeland Security...

Email Security

Many Fortune 500, FTSE 100 and ASX 100 companies have failed to properly implement the DMARC standard, exposing their customers and partners to phishing...

Application Security

Virtualization technology giant VMware on Tuesday shipped urgent updates to fix a trio of security problems in multiple software products, including a virtual machine...


Enterprise users have been warned that cybercriminals may be trying to phish their credentials by luring them with fake emails that appear to be...

Application Security

Microsoft on Tuesday pushed a major Windows update to address a security feature bypass already exploited in global ransomware attacks.The operating system update, released...