Why Secure Email Gateways (SEGs) Fail
Organizations invest heavily in automated email filters, behavioural AI scanners, and domain authentication protocols (SPF, DKIM, DMARC). These defences are designed to catch high-volume automated spam and known malicious infrastructure.
Targeted spearphishing routinely slips past these perimeter controls because it abuses legitimate trust:
- Compromised Vendor Infrastructure Attackers send emails from legitimate, compromised accounts belonging to your existing suppliers or clients, sailing clean through reputation filters.
- Abuse of Legitimate Cloud Services Phishing payloads are frequently hosted on trusted platforms like Microsoft SharePoint, Google Drive, DocuSign, or Notion, which email filters cannot simply block without disrupting normal business operations.
- Living-off-the-Conversation Attackers hijack existing email threads, replying directly to ongoing operational discussions with updated attachments or payment instructions.
When an email arrives from a trusted source, technical controls yield to human judgment. If that judgment fails, the attacker receives valid credentials, establishes persistent inbox access, and moves laterally without raising a single technical alarm.
The Operational Failure Modes We Test
We do not design tests to trick employees with impossible technical puzzles. We test the organizational seams where communication velocity, routine business pressure, and interface familiarity override standard verification policies.
01
Modern Credential Harvesting & Session Token Theft
Traditional phishing captures a static password, which is immediately blocked by multi-factor authentication (MFA). Modern adversaries bypass MFA entirely using Adversary-in-the-Middle (AiTM) reverse proxies that capture both the password and the live session cookie in real time.
- SSO Portal Replication Evaluating how staff respond to pixel-perfect authentication portals (Microsoft 365, Google Workspace, Okta) that proxy real-time login sessions.
- MFA Fatigue & Push Exhaustion Measuring whether employees accept unprompted authentication pushes or supply one-time passcodes (OTP) when prompted by an interface claiming an active session has timed out.
- Secondary Administrative Access Testing whether IT personnel and system administrators will enter privileged credentials into urgent infrastructure-update alerts.
02 · The Invoice Swap
Context-Driven Financial Deception
Wire fraud rarely begins with an external cold email. It begins when an attacker quietly monitors an accounts payable inbox, waits for a legitimate transaction to reach the final approval phase, and intercepts the exchange.
- Modified Payment Details Determining whether procurement, billing, and executive desks accept revised transit numbers, banking details, or payment portal links sent in the middle of active invoice workflows.
- Urgent Deal & Escrow Pretexts Simulating closing-day transaction modifications, time-sensitive supplier pre-payments, and executive wire overrides that test whether staff abandon mandatory callback procedures.
- Vendor Impersonation Testing whether accounts payable clerks verify invoice alterations against established master records or rely solely on email-based confirmations.
03 · Illicit OAuth Abuse
Cloud Application Consent Grants
Attackers increasingly bypass credential harvesting altogether by tricking users into granting third-party permissions to malicious cloud applications.
- Single-Click Inbox Takeover Testing whether employees grant authorization to seemingly benign internal apps (e.g., "ScheduleSync," "Document Reviewer," or "HR Portal") that request permissions to read, write, and forward corporate mail.
- Shared Workspace Exploitation Measuring workforce response to collaborative document invites (SharePoint, Box, DocuSign) requiring broad permissions to view confidential materials.
04
The Reporting Velocity Deficit
In a targeted attack, human error is an inevitability; silence is what makes it fatal. A successful defence depends on how rapidly an organization identifies an intrusion and sounds the alarm.
- Time-to-First-Click vs. Time-to-First-Report Measuring the critical operational window between when a malicious email lands, when the first user interacts with it, and when your security operations centre (SOC) or IT team receives a formal report.
- Reporting Friction Evaluating whether employees report suspicious emails immediately or hesitate due to confusing reporting mechanisms, complex ticketing queues, or fear of reporting false positives.
Compliance-Driven Phishing vs. Adversarial Emulation
| Feature | Commodity Phishing Platforms | Adversarial Email Emulation |
|---|---|---|
| Attack Scenarios | Generic, mass-produced templates (gift cards, fake package deliveries). | Bespoke, intelligence-led pretexts matching your industry, vendors, and workflows. |
| Authentication Testing | Simple forms collecting static passwords (rendered obsolete by MFA). | Realistic AiTM and session-interception simulations that evaluate true MFA resiliency. |
| Delivery Mechanism | Whitelisted internal blasts that bypass all perimeter defences artificially. | Realistic delivery testing that evaluates whether your filters, gateways, and staff catch the threat. |
| Primary Metric | Basic click rate (used to assign punitive training modules). | Comprehensive reporting velocity, credential submission rates, and organizational MTTD. |
| Workforce Impact | Cynicism, embarrassment, and employee frustration. | Blameless, constructive operational coaching that turns employees into active detection sensors. |
Safe-Testing Standards & Guardrails
Real-world attack emulation must never compromise the confidentiality of your systems, the integrity of your network, or the trust of your workforce.
[ Phase 01: Profiling ] ──► [ Phase 02: Formulation ] ──► [ Phase 03: Delivery ] ──► [ Phase 04: Telemetry ] Analyze external footprint Build realistic, context- Execute controlled, safe Measure click/report and vendor ecosystem. driven business pretexts. spearphishing campaigns. velocity & debrief.
[ Phase 01: Profiling ] Analyze external footprint and vendor ecosystem. │ ▼ [ Phase 02: Formulation ] Build realistic, context- driven business pretexts. │ ▼ [ Phase 03: Delivery ] Execute controlled, safe spearphishing campaigns. │ ▼ [ Phase 04: Telemetry ] Measure click/report velocity & debrief.
- Zero Credential Ingestion Our simulated landing pages use benign, non-recording validation tokens. We capture the exact timestamp of an interaction to prove access was possible, but we never record, store, or view actual employee passwords or personal information.
- No Destructive Payloads We never deploy malware, drop macro-enabled attachments, or execute unauthorized code on client endpoints. All links and documents lead strictly to controlled, secure simulation environments.
- Immediate Constructive Feedback When a user interacts with a simulation, they are not redirected to a punitive warning screen. They are presented with a concise, blameless educational breakdown highlighting the subtle indicators of the email and the proper reporting procedure.
- Blameless Findings We evaluate systemic risk, filter effectiveness, and reporting workflows. Deliverables never include employee names, nor are findings formatted for human resources disciplinary actions.
What the Deliverable Looks Like
Our reporting translates campaign telemetry into actionable engineering and procedural changes:
Executive Risk Briefing
A strategic analysis mapping email vulnerabilities directly to business exposure, regulatory mandates, and wire fraud risks.
The Telemetry Timeline
An end-to-end breakdown charting email delivery, first open, first interaction, and first employee report—identifying your true organizational Mean Time to Detect (MTTD).
Defensive Gateway Audit
An objective assessment of which email lures were intercepted by your secure email gateways, which were flagged as suspicious, and which reached the inbox untouched.
Procedural Remediation Playbooks
Concrete recommendations for updating accounts payable callback verification protocols, optimizing inbox reporting buttons, and tightening technical email filtering rules.
Other services
Start here