Almost every organization reports experiencing email security incidents – and legacy approaches to technology and training can’t keep pace with evolving threats.

The 500 Cybersecurity leaders who were independently surveyed for this report made two things very clear: they remain vulnerable to both inbound phishing attacks and outbound data loss and exfiltration, and they are questioning the effectiveness of traditional approaches to email security.

EMAIL SECURITY INCIDENTS

94% of our respondents experienced email security incidents in their Microsoft 365 environment in the last 12 months, which is consistent with our 2023 finding of 93%. Almost all organizations experienced both inbound and outbound incidents, with 94% falling victim to phishing and 91% to data loss and exfiltration.

It’s only natural, then, that 95% of Security leaders said they are stressed about email security. Phishing attacks sent from compromised supply chain accounts are the top cause of stress, followed by internal account takeover (from credential harvesting), and wire fraud. Additionally Cybersecurity leaders admit to being kept awake at night by the use of AI in attacks. 63% are concerned about deepfakes and 61% by generative AI and chatbots. Understandably, there’s a sense that doing what we’ve always done is no longer good enough.

INBOUND DETECTION

For inbound detection, 91% of our respondents that use secure email gateways (SEG) expressed frustrations with them, while 88% voiced concerns with Microsoft’s native controls. On the outbound, meanwhile, 83% find static DLP rules unworkable for employees and administrators.

Cybersecurity leaders also have reservations about traditional security awareness training (SAT), with 91% worrying about the effectiveness
of their current program.

However, change is coming. 87% of organizations are on the journey to move away from their SEG, either considering or committing to replacing it with Microsoft’s controls and integrated cloud email security (ICES) solutions.

In this report, we analyze these risks to inbound and outbound email security, as well as assess the effectiveness of the technical controls and SAT programs our respondents use. All data comes from an independently commissioned survey of 500 Cybersecurity leaders, all using
Microsoft 365 as their cloud email platform.

Read more details on the Egress Email Security Risk Report 2024.

More posts