Email security is the set of controls that stop phishing, impersonation and malicious attachments from reaching your team, and stop attackers sending mail that appears to come from your domain.
The short answer
Email security covers two directions. Inbound: filtering messages that carry phishing links, malicious attachments or payment fraud. Outbound: publishing SPF, DKIM and DMARC records so nobody else can send mail claiming to be your domain. Most breaches still start with an email, which is why buyers and auditors both ask about it.
The attacks that succeed rarely look technical. A convincing message asking for a payment redirect or a password reset defeats a filter tuned only for malware.
On this page
The threats that get through
| Threat | What it looks like |
|---|---|
| Credential phishing | A convincing login page reached from a link, harvesting the password and often the one-time code too |
| Business email compromise | No link, no attachment, just a plausible request to change bank details or approve a payment |
| Domain impersonation | A lookalike domain, or your real domain spoofed because DMARC is not enforced |
| Malicious attachments | Documents and archives carrying a payload, often password protected to defeat scanning |
| Thread hijacking | A reply injected into a real conversation from a supplier whose mailbox was already compromised |
The one with no technical signature
Business email compromise carries nothing for a scanner to detect. It is caught by behavioural signals, by payment approval processes that require a second channel, and by staff who know to verify.
SPF, DKIM and DMARC
Three DNS records that together let a receiving server decide whether mail claiming to be from your domain really is. They protect your customers and partners from being phished in your name.
Layers of email security
Filter at the gateway
Reputation, attachment analysis and link rewriting, applied before the message reaches a mailbox.
Authenticate the domain
SPF, DKIM and DMARC at enforcement, so nobody can send as you and your mail is trusted.
Train and verify
Awareness training plus a rule that payment or bank detail changes are confirmed on a second channel.
How Osto protects the inbox
Osto provides inbound email security, filtering phishing attempts and malicious payloads before they reach your team. Because it runs in the same platform as endpoint control, MFA and the SIEM, a suspicious message can be correlated with what happened next on the recipient’s device and account, which is how a click gets caught before it becomes an incident. Security awareness training is built into the compliance platform, so the human layer produces evidence too.
Free security assessment
Stop the email before someone clicks it
Osto filters inbound phishing and malicious payloads, and correlates a suspicious message with what happened next on the device.
Get a free security assessment Book a platform walkthroughInbound filtering · Endpoint correlation · One platform, everything
Frequently asked questions
What is email security?
The controls that protect an organisation’s email: filtering inbound phishing and malicious attachments, and publishing SPF, DKIM and DMARC records so attackers cannot send mail that appears to come from your domain.
What is the difference between SPF, DKIM and DMARC?
SPF lists which servers may send on your behalf. DKIM adds a cryptographic signature proving the message was not altered. DMARC tells receiving servers what to do when SPF or DKIM fails, and sends you reports.
Is Microsoft 365 or Google Workspace filtering enough?
Both filter well for volume spam and known malware. They are weaker against targeted phishing and business email compromise, which carry no malicious payload. Most organisations add a layer and enforce DMARC.
Why is DMARC at “none” a problem?
A policy of none means receiving servers report failures but deliver the message anyway. Impersonation still lands. Protection begins only when the policy is moved to quarantine or reject.
Do frameworks require email security?
ISO 27001:2022 covers malware protection in Annex A 8.7 and awareness training in A 6.3. SOC 2 auditors look for threat protection and training records. Security questionnaires ask about phishing controls and DMARC enforcement directly.