Email security is the set of products that protect a company's employees from harmful email: fake messages, harmful attachments, and emails that strangers send in the company's name. Email is where many attacks on people begin, because an email reaches a person directly, inside the company.
Take, for example, the accounts team at a ceramic tile maker in Morbi. One morning, an email arrives from a regular supplier of glaze. It says that the supplier has changed banks, and asks for this month's payment of ₹6 lakh to go to a new account. There is no attachment and no strange link. But the sender's address differs from the real one by one letter. If the team pays, the money goes to the attacker. This kind of fraud is called business email compromise, or BEC. It is one kind of phishing.
The industry built three defences, one after another. The first is the secure email gateway, a filter that checks every incoming email before it reaches any inbox. It blocks harmful files and links, and it checks whether the sender is real. One of its checks uses DMARC and email authentication, records with which a company publishes the servers that may send mail in its name.
The second defence is integrated cloud email security (ICES). It reads mail inside the mailbox and learns who normally writes to whom, and about what. A sudden request to change a supplier's bank account does not fit that pattern, so it flags the message.
The third defence is the person. Security awareness training teaches employees to stop and check, for example by phoning the supplier on a number they already know before changing any bank details.
Attackers now use AI to write phishing emails without spelling mistakes. Defenders use the same kind of AI to judge the tone and intent of each message. This contest is described in AI in cybersecurity. Every message that these defences flag is also sent to the company's SIEM, where the security team can search for the same attack in other mailboxes.