13 email threat types to know about right now

Radically reduce susceptibility to targeted email attacks

A cyberattack can affect your business in many ways, depending on its nature, scope, and severity. According to the FBI’s Internet Crime Complaint Center (IC3), cybercrime cost £2.6 billion in losses in 2019 alone, with business email compromise (BEC) causing the most damages. That doesn’t include unreported losses, which are significant. IC3 received 467,361 complaints last year—more than 1,300 per day—with phishing responsible for 93 percent of email breaches. There can be a variety of indirect and intangible costs from attacks, too, such as legal fees, regulatory fines, operational disruptions, a damaged brand reputation, and other severe consequences.

In today’s rapidly evolving environment, traditional email security solutions aren’t enough to protect businesses anymore. You must also effectively defend against sophisticated email threats that are often able to bypass defenses by using backdoor techniques, including spoofing, social engineering, and fraud, to penetrate networks and wreak havoc.

While comprehensive email gateway defenses provide a solid foundation, using a multilayered protection strategy radically reduces susceptibility to email attacks and helps better defend your business, data, and people.

This article takes an in-depth look at the top email threat types, including their risks and impact on businesses, and how AI and API-based inbox defense can address the gaps in the email gateway and help provide total email protection against attacks.

Through 2023, BEC attacks will continue to double each year to over £5 billion and lead to large financial losses for enterprises.

Fighting increasingly complex email attacks

The email and phishing threats faced by organizations today vary greatly in complexity, volume, and the impact they have on businesses and their employees. There are a number of distinct categories of email threats:

• Spam: These are unsolicited, high-volume messages generally of a commercial nature, which are sent without regard to the recipient’s identity.

• Malware: This is software specifically designed to cause damage to technical assets, disrupt operations, exfiltrate data, or otherwise gain access to a remote system. Malware is usually distributed through email attachments or URLs leading to malicious content.

• Data Exfiltration: These types of attacks occur when data is copied or retrieved from a remote system without the owner’s consent. It can occur maliciously or accidentally.

• Phishing: These emails attempt to trick an end user into believing the message is from a trusted person or organization to get them to take an action like disclosing credentials, wiring money, or logging into a legitimate account on an attacker’s behalf.

• Impersonation: This category includes any attack where the malicious actor pretends to be a person, organization, or service. It’s a broad superset of attacks that usually go hand in hand with phishing.

A total of 13 email threat types fall into these categories. Some of these attacks are used in conjunction with others; hackers often combine various techniques. For example, many spam messages include phishing URLs, and it’s not uncommon to see a compromised account be used in internal or lateral wire fraud. Understanding the nature and characteristics of these attacks helps build the best protection for your business, data, and people.

Here’s a look at the top 13 email threat types and how to strengthen your email security posture against them. As email attacks get more complex, they become harder to defend against.