What signals does email security provide?
An email gateway, or the native protection in Microsoft 365 and Google Workspace, generates data that is useful for more than filtering. Once it is integrated, the SOC receives:
- Phishing, malware, spam and spoofing verdicts, with the reason for each classification.
- Message metadata: sender, sending domain, SPF, DKIM and DMARC results, source IP and recipients.
- Clicks on rewritten links: who clicked, when, and whether the URL was blocked at that moment.
- Messages that users report as suspicious.
- Post-delivery reclassifications: messages moved to quarantine hours later.
- Mailbox activity, when the integration includes it: forwarding rules, delegated access and mass sending from an internal account.
Which email attacks are easier to detect by combining sources?
Almost any filter will block a phishing email with a known attachment. The hard cases are different:
- BEC and CEO fraud: a plausible message asking for an urgent payment or a change of bank account, with no link or attachment to analyze. Cross-referencing data helps: a lookalike domain registered a few days earlier, the first time that sender has written to finance, or a reply-to address that points somewhere else.
- Compromised supplier: the email comes from a legitimate domain, passes SPF and DKIM and continues a real conversation. The clue is the change of bank details or an unusual sending IP.
- Links that activate later: the URL is harmless at delivery and, hours later, redirects to a credential theft page.
- Credential theft followed by access: a user enters their password on a fake page, and shortly after there is a sign-in from another country and a rule that hides replies. You only see the full picture if email and identity are integrated.
The financial impact explains the priority. According to the FBI IC3's 2025 annual report, that year the agency received 24,768 BEC complaints with reported losses of more than $3 billion, the category with the second-highest losses in the report, behind only investment fraud.
What can you do when malicious email is already in mailboxes?
Email response has one particularity: the same message has often reached dozens of people. These are the usual actions, depending on the tool:
| Action | What it achieves | Examples by tool |
|---|---|---|
| Remove the message from every mailbox | No one else opens it, even if it has already been delivered or read. | Remediation in Microsoft Defender for Office 365, auto-pull in Proofpoint, remediation in Mimecast, the security investigation tool in the Google Workspace editions that include it. |
| Block a sender, domain or URL | Stop new emails from the same campaign. | Tenant Allow/Block List in Microsoft 365, gateway policies (Proofpoint, Mimecast, FortiMail), blocked senders in the Google Workspace Admin console. |
| Identify who interacted | Prioritize anyone who clicked or opened the attachment. | Click logs for rewritten links and delivery reports. |
| Escalate to identity and endpoint | Contain the threat if someone entered credentials or ran the attachment. | Revoke sessions and force a password change; isolate the device from the EDR. |
The provider's automatic purge is not always enough. In Microsoft 365, zero-hour auto purge (ZAP) only acts on email delivered in the last 48 hours, and its effect depends on the actions configured in the policies, according to Microsoft's documentation. A campaign identified three days later needs a removal launched by the SOC.
How does it differ from identity and endpoint integrations?
Email sees the attempt: who sent what to whom. Identity sees whether the attempt worked, through a sign-in that uses the stolen password, and the endpoint sees whether anything ran on the device. If you only integrate email, you'll know a phishing email arrived but not whether anyone fell for it. That's why these three integrations are usually enabled together.
What should you check in your email setup?
- A phishing report mailbox or button that reaches the SOC, not just the IT team.
- DMARC published for your domains, at least in monitoring mode (p=none), so you know who is sending on your behalf.
- An out-of-band verification procedure for any bank account change, which stops BEC better than any filter.
How Ciberia helps
Ciberia MDR integrates with your email platform or security gateway, and its AI agents correlate its signals with identity, endpoint and network, enriched with indicators from Ciberia Intel. When an email is confirmed as malicious, the AI proposes the response, an analyst validates actions with impact, and containment is orchestrated according to the tool: removing the message from the affected mailboxes, blocking the sender and reviewing who interacted. Monitoring is 24/7 and every action is logged: who, when, on what criteria and on what data.
