When the obvious gets through

What a phishing campaign reveals about the limits of email security – and why partners should be asking harder questions

There is something particularly concerning about a phishing email that manages to bypass an organisation's email security defences when it carries the kinds of warning signs that security professionals have spent years teaching people to recognise.

It raises an uncomfortable question: if the obvious can get through, how confident should businesses really be in the protection sitting between their employees and their inboxes?

For IT partners, resellers and managed service providers, it also raises an important question: are the email security solutions being recommended to customers delivering the level of protection those customers expect?

That question was brought into focus by a recent report from Dark Reading, which detailed a phishing campaign impersonating artificial intelligence company Anthropic. According to the report, the campaign involved fraudulent early-access invitations designed to steal Google and Microsoft account credentials.

What makes the incident noteworthy is not simply the impersonation of a high-profile technology brand. It is the reported ability of the emails to evade established email security controls, including some leading Secure Email Gateways (SEGs) and Microsoft Defender for Office 365.

The campaign contained several features that, viewed in isolation, might have raised suspicion:

• An unrelated sender address.
• A shortened URL.
• A misspelt sender display name.
• A relatively basic-looking message.
• CAPTCHA challenges designed to frustrate automated scanning and security analysis.

These techniques are not necessarily sophisticated in themselves. But they illustrate a persistent challenge for email security: attackers do not need to invent an entirely new way to deceive people if they can find a way to get a familiar-looking scam past the systems intended to stop it.

And that is where the wider issue begins.

A recognised brand is not a security guarantee

For many organisations, choosing an email security solution is influenced by familiarity. Large, established technology brands are often perceived as the safe choice. Their market presence, reputation and extensive product portfolios can create confidence that their security capabilities will be equally comprehensive.

There is also a growing tendency to consolidate technology suppliers. For organisations already operating within the Microsoft ecosystem, using Microsoft's security products can appear to be the logical next step. Fewer vendors can mean simpler procurement, administration, integration and supplier management.

There are legitimate business reasons to pursue consolidation. But convenience and security performance are not the same thing.

For partners advising customers, this distinction matters. A recommendation based primarily on brand familiarity or the convenience of an existing technology ecosystem may not necessarily deliver the best outcome for the customer's security requirements.

The question should not simply be whether email security comes from a recognised provider, or whether it is convenient to bundle with other services. It should be whether that protection is consistently identifying and stopping the threats targeting the customer's people and business.

The Dark Reading report does not establish that every customer using Microsoft or a leading SEG is exposed, nor does one campaign provide a comprehensive assessment of any provider's overall effectiveness. It does, however, offer a timely reminder that even widely adopted security products can have blind spots.

For partners, it reinforces the importance of looking beyond vendor reputation and asking for evidence of performance.

The changing nature of email threats

Email remains an attractive attack channel because it exploits something that technology alone cannot easily eliminate: human trust.

A convincing message can prompt an employee to open an attachment, follow a link, disclose credentials or approve a payment. The attacker may not need to compromise the organisation's network directly. They may only need one person to believe that a message is legitimate.

And the appearance of a phishing email is no longer a reliable indicator of how dangerous it might be.

Some attacks are crude and contain obvious spelling mistakes, suspicious links or implausible requests. Others are carefully constructed to imitate trusted suppliers, colleagues, executives and well-known brands. Business Email Compromise (BEC), supplier impersonation and credential-harvesting attacks can be particularly difficult to identify because they are designed around familiar business processes and relationships.

Attackers also continue to adapt their techniques to frustrate security controls. They can manipulate links, alter message content, use legitimate services as part of their delivery infrastructure and vary the appearance of messages across a campaign.

The Anthropic-themed campaign reported by Dark Reading is a useful example. Its use of a legitimate GoTo Webinar sender address and CAPTCHA challenges demonstrates how attackers can introduce elements that complicate automated inspection and make a message harder to assess.

The report also raises the possibility of AI-assisted campaign creation, although it does not confirm that generative AI was used in this incident. That distinction matters. The broader lesson is not that every new phishing campaign is AI-generated, but that attackers continually adapt, and security controls must evolve with them.

Email security cannot stand still

A modern email security solution needs to do more than recognise yesterday's malicious attachments and known phishing links.

It needs to assess multiple signals, understand context, identify suspicious behaviour and respond to emerging attack patterns. It must be capable of identifying both familiar threats and variations that have not previously been seen.

That requires a layered approach. Different detection techniques bring different strengths, and relying too heavily on a single method can leave gaps.

With MailGuard, this philosophy is reflected in a security architecture developed through more than 25 years of specialist email security engineering. Its detection approach combines proprietary AI and machine learning models, semantic analysis, threat intelligence, behavioural signals, rules and heuristic detection. These models work together through a proprietary orchestration engine to assess threats from multiple perspectives.

The objective is to identify malicious intent and suspicious patterns, not simply match an email against a list of previously identified threats.

This distinction is increasingly important as attacks become more targeted and convincing. A fraudulent message may contain no malicious attachment, and its link may not yet appear on a blocklist. It may instead rely on impersonation, unusual communication behaviour or a carefully engineered request.

For partners, understanding how a security solution approaches these challenges is an important part of making an informed recommendation. The number of features on a product sheet is less meaningful than understanding how the different layers work together to identify and stop threats.

Technology is only part of the equation

There is another consideration that can be overlooked when organisations evaluate email security: the people behind the technology.

Security platforms are not simply installed and forgotten. Every customer has different communication patterns, supplier relationships, user behaviours, risk profiles and operational requirements. Their security arrangements need to reflect those differences.

A solution that is not appropriately configured, monitored and optimised may not deliver the protection an organisation expects. And when a new threat emerges or something unusual happens, access to knowledgeable security professionals can make a meaningful difference.

This is particularly relevant for IT partners and MSPs, who are often expected to provide customers with ongoing guidance and reassurance as their technology environments evolve.

A security provider should be more than a product supplier. It should be a partner that supports the people responsible for protecting the customer's business.

MailGuard is supported by a team of cybersecurity experts available 24/7 to assist customers, investigate issues and help optimise protection for their particular circumstances. Its approach also combines automated detection with human-led threat intelligence and validation, recognising that technology provides scale and speed while experienced security professionals bring contextual judgement.

For partners, this provides access to specialist expertise that can complement their own customer relationships and support responsibilities. It also means customers have people available to help ensure their email security arrangements remain appropriate as their business, users and threat environment change.

The question is not simply whether a provider can supply an email security platform. It is whether that provider will stand behind the technology and help ensure it continues to perform.

Helping customers ask better questions

The lesson from the Anthropic-themed phishing campaign is not that one vendor should automatically be chosen over another. Nor is it that organisations should abandon consolidated technology environments.

It is that security decisions deserve more scrutiny than brand recognition or purchasing convenience alone.

Partners are well placed to lead this conversation. Rather than allowing familiarity, bundling or procurement simplicity to determine the outcome, they can help customers assess what their email security is actually delivering.

When reviewing an existing email security solution, there are several questions worth raising:

• What is actually being detected? Ask for meaningful reporting on the threats being intercepted, including phishing, impersonation, credential harvesting and business email compromise.
• How quickly are new threats identified? Detection speed matters. A threat that is eventually identified may already have reached employees and caused harm.
• How does the solution handle unfamiliar attacks? Understand how it identifies suspicious messages that do not match known signatures, malicious URLs or established threat patterns.
• How is protection adapted to the customer's organisation? Consider how configuration, policies and detection are tuned to reflect the business, its users and its risk profile.
• What expertise is available when it is needed? Find out whether experienced cybersecurity specialists are accessible, how they support incident investigation and whether they proactively help optimise security performance.
• What evidence demonstrates that the solution is working? Look beyond product claims. Request reporting, examples and meaningful insight into the threats being stopped and the risks that remain.

These questions are relevant whether a customer uses a specialist email security provider, a broader cybersecurity platform or the security capabilities bundled with an existing productivity environment.

They also create an opportunity for partners to demonstrate value beyond the initial technology deployment: helping customers make better-informed decisions, understand their exposure and maintain an appropriate level of protection over time.

The real test is what gets stopped

The email security market is crowded with established brands, extensive feature lists and increasingly sophisticated claims about artificial intelligence and threat detection.

But the real test of any security solution is not how familiar its name is, how many features appear on its website or how conveniently it fits into an existing technology agreement.

It is how well it performs when a real threat arrives.

The campaign reported by Dark Reading is a timely reminder that organisations should not confuse market reputation with guaranteed protection. Even messages containing warning signs can find their way through established defences. And as attackers continue to adapt, businesses cannot afford to treat email security as a procurement decision they make once and never revisit.

For partners, this is an opportunity to challenge assumptions and bring greater scrutiny to the security decisions being made on behalf of customers.

The strongest customer relationships are built on trust, sound advice and solutions that deliver meaningful outcomes. That means asking difficult questions of security providers, looking beyond familiar names and ensuring that the technology is supported by the expertise needed to make it work effectively.

The question is not whether your customers have email security. It is whether that security is doing the job they believe it is doing.

When the obvious gets through, it is time to ask some harder questions.

Keeping Businesses Safe and Secure

Prevention is always better than a cure, and one of the best defences is to encourage businesses to proactively boost their company's cyber resilience levels to avoid threats landing in inboxes in the first place. The fact that a staggering 94% of malware attacks are delivered by email, makes email an extremely important vector for businesses to fortify.

No one vendor can stop all email threats, so it's crucial to remind customers that if they are using Microsoft 365 or Google Workspace, they should also have a third-party email security specialist in place to mitigate their risk. For example, using a specialist AI-powered email threat detection solution like MailGuard.
For a few dollars per staff member per month, businesses are protected by MailGuard's specialist, AI-powered zero-day email security. Special Ops for when speed matters! Our real-time zero-day, email threat detection amplifies your client's intelligence, knowledge, security and defence.

MailGuard provides a range of solutions to keep businesses safe, from email filtering to email continuity and archiving solutions. Speak to your clients today to ensure they're prepared and get in touch with our team to discuss fortifying your client's cyber resilience.

Talk to us

MailGuard's partner blog is a forum to share information; we want it to be a dialogue. Reach out to us and tell us what your customers need so we can serve you better. You can connect with us on social media or call us and speak to one of our consultants.

Australian partners, please call us on 1300 30 65 10

US partners call 1888 848 2822

UK partners call 0 800 404 8993