Top 5 Tips for Solving the Email Security Problem

Here’s something that should bother every IT leader: email keeps catching organisations off guard.

We’re not talking about naive users clicking obvious scams. Modern phishing is engineered. It uses your suppliers’ real email addresses. It clones your bank’s login page down to the favicon. It arrives at 7 am on a Tuesday, written in the exact tone your CFO uses, asking you to approve a transfer before the board meeting. And it works.

So, what do you do about it? We’ve put together five things that work — not in theory, but in practice, based on what resilient security teams are getting right.

In this guide

• Tip 1: Your Secure Email Gateway Is Not Enough
• Tip 2: DMARC, DKIM, and SPF
• Tip 3: Your Annual Security Training Isn’t Working
• Tip 4: MFA Can Be Beaten
• Tip 5: Stopping the Email Is Not Enough
• How Sthenos Can Help
• Final Thoughts
• Related reading

Tip 1: Your Secure Email Gateway Is Not Enough — And Attackers Know It

When most organisations think about email security, they think about their Secure Email Gateway. And fair enough — SEGs have been the standard for years. The problem is that attackers spent those same years figuring out exactly how to get around them.

Traditional SEGs work by checking emails against known threat signatures, spam patterns, and blacklisted domains. That works fine for the threats of five years ago. Today’s attacks don’t look like threats. They arrive from legitimate cloud services. They use real domains with valid DMARC records. The login page they link to is a pixel-perfect copy of Microsoft 365, hosted on a domain registered three days ago. A legacy SEG looks at that email and sees nothing wrong.

What works is adding a layer that operates post-delivery, inside the mailbox, not just at the perimeter. API-based inline tools analyse email behaviour patterns, flag anomalies in sender relationships, and catch things that look clean at the gateway. They work on different signals entirely — which is exactly what you need when attackers have already reverse-engineered the first layer.

Actions worth taking:

Tip 2: DMARC, DKIM, and SPF — Have You Actually Set These Up Properly?

If your organisation doesn’t have SPF, DKIM, and DMARC configured correctly, stop reading and go fix that first. Genuinely. These protocols are the foundation — they tell receiving mail servers whether an email from your domain actually came from you, and they prevent attackers from impersonating your brand in emails sent to your own customers and partners.

But here’s where a lot of organisations get it wrong: they set DMARC up and leave it in monitor mode. Monitor mode means you’re collecting reports on who’s sending email from your domain. It does not mean spoofed emails are being blocked. That only happens when you move to ‘p=quarantine’ or ‘p=reject’, and plenty of IT teams never make that jump because they’re worried about breaking legitimate email flows.

There’s also a more fundamental limitation worth understanding. DMARC validates the domain in the visible ‘From’ header. That’s it. Attackers get around this by registering lookalike domains — swap one character, add a hyphen — that pass DMARC cleanly because they’re technically different domains.

Actions worth taking:

Tip 3: Your Annual Security Training Isn’t Working — Here’s What Does

33.2%  of employees with no training will click a phishing link. With continuous simulation-based training, that rate drops to 4.2%.  — KnowBe4

Almost every organisation does security awareness training. Almost none of them do it in a way that actually changes behaviour.

The typical setup: once a year, employees watch a 20-minute video about not clicking suspicious links, answer a quiz, get their certificate, and move on. From a compliance standpoint, the box is ticked. From a security standpoint, virtually nothing has changed. They’ve learned nothing about the specific types of attacks their role and organisation actually face.

The harder truth is that phishing works not because people are careless or uninformed, but because attackers are genuinely good at what they do. New hires are more likely to click, before they’ve built up enough context about how their organisation operates to spot something off.

What actually works is training that’s continuous, role-specific, and delivered through realistic simulation rather than passive video. The difference isn’t huge effort; it’s a different model entirely.

There’s also a cultural piece that’s easy to overlook. If your culture makes people afraid to report mistakes, you’re paying for the cover-up in detection time.

Actions worth taking:

Tip 4: MFA Can Be Beaten — Make Sure Yours Can’t

MFA is one of the best investments you can make in access security. It’s also increasingly a false sense of security for organisations that haven’t thought carefully about how they’ve implemented it.

Here’s what an AiTM attack looks like in practice. An employee gets a convincing phishing email and clicks through to what looks like their Microsoft 365 login page. They enter their credentials, complete their MFA push notification — everything looks fine. What actually happened: a malicious proxy sat between them and the real login page, captured their session cookie the moment MFA completed, and handed the attacker live access to the account. The MFA event happened. It just didn’t stop anything.

Then there’s MFA fatigue, which is exactly what it sounds like. Attackers flood a user’s authenticator app with push requests until they approve one just to make it stop.

The solution is phishing-resistant MFA. FIDO2 authentication — hardware keys like YubiKey or passkeys on modern devices — works differently to push-based MFA. It cryptographically binds the authentication to the specific legitimate domain. A cloned login page on a slightly different domain produces a different cryptographic challenge, which fails. There’s no session cookie to capture because there’s no way to complete the authentication through a proxy in the first place.

Actions worth taking:

Tip 5: Stopping the Email Is Not Enough — Think About What Happens After

This is the one that catches a lot of security teams out. The entire focus of email security investment tends to be on the inbox — stop the bad email from arriving, and the problem is solved. But the most costly email attacks often don’t involve a ‘bad’ email in any technical sense.

Take Business Email Compromise. A BEC attack doesn’t need to deliver malware or bypass a spam filter. The email itself is the weapon — a message that looks exactly like it came from your CEO or a trusted supplier, asking someone in accounts payable to update banking details or approve a transfer. If the message gets through and the person doesn’t question it, the money leaves and it doesn’t come back. There’s nothing for your SEG to flag. There’s no malicious link. It’s a social engineering attack delivered over email, and it’s extraordinarily effective.

The response to this isn’t purely a technology problem. It’s partly process — high-risk financial actions triggered by email should require out-of-band verification regardless of how legitimate the email looks. A quick phone call to confirm a banking change costs nothing. Wiring money to the wrong account costs a lot.

On the technology side, effective protection means integrating your email security signals with your wider detection infrastructure — your EDR, your SIEM, your identity platform. A suspicious email event should trigger downstream monitoring, not just a one-time filter verdict. No spam filter will catch an email from a real supplier you’ve worked with for three years. Behavioural anomaly detection is the only thing that will.

Actions worth taking:

How Sthenos Can Help

Email security isn’t a product you buy and forget. It’s a set of overlapping decisions — about architecture, tooling, process, and people — that need to work together. Getting one layer right while leaving gaps in another is how organisations end up spending money on security and still getting breached.

We’ve worked with enterprises across industries on exactly this problem. Our approach starts with understanding where your real exposure is, not just running through a compliance checklist. That means looking at your actual email flows, your current tooling, where your people are clicking, and how your authentication is configured — then prioritising fixes based on genuine risk, not theoretical frameworks.

Specifically, we help with:

• Email Security Assessments — reviewing your SEG configuration, authentication setup, MFA implementation, and awareness posture, with a practical roadmap of what to address first.
• Security Architecture — designing and building layered email security that combines perimeter and post-delivery controls, integrated with your existing stack.
• Identity & Access Management — hardening MFA across your environment, migrating high-risk accounts to phishing-resistant authentication, and tying identity controls to email security signals.
• Security Awareness Programs — building continuous, simulation-based training that reflects the threats your organisation actually faces, not generic content.
• MDR Integration — connecting email security into your broader SOC environment so threats that make it past the inbox don’t disappear into a blind spot.

If you want to know where your gaps actually are, we’re happy to start with a conversation. The answer is usually more specific — and more fixable — than most teams expect.

Final Thoughts

AI is making the problem harder — better lures, more volume, faster adaptation to whatever defences you put in place.

None of the five tips here are magic. But they do represent where the gap tends to be between organisations that take email security seriously and those that are still relying on a gateway and an annual training video.

The good news is that the fundamentals are well understood. Most organisations aren’t being breached because the attackers are technically superior — they’re being breached because the basics weren’t done, or weren’t done completely. That’s a solvable problem.

Related reading