For a cybercriminal, getting past secure email gateways (SEGs) is just the price of doing business. It is literally equivalent to falling at the first hurdle when a SEG detects something at the perimeter.

Although this picture has begun to shift in recent years (more on that below), SEGs have been widely embraced, particularly in larger businesses.

Many native controls in email platforms (such as Microsoft Exchange) function according to the same principles, even in cases where enterprises do not employ an SEG. A cybercriminal will therefore be quite certain that in order to access a target's inbox, they must pass through at least a SEG or comparable layer.

Like most of us, cybercriminals need or want to be paid at the end of the day, and they can be extremely cunning. They will do all in their power to modify their attacks in order to avoid detection if email security technology gets in the way of their plans.

Here is some evidence. A screenshot from the dark web is shown below. It displays information about a phishing toolkit that requires a subscription and gives users access to more than thirty brand impersonation templates. It comes with round-the-clock service and is promoted for $300 per month or $1,000 for lifetime access.

Importantly, named SEG vendors are guaranteed to be avoided by the payloads.

These bits come together to create an intriguing image. In order to develop recurring commerce, the cybercriminal selling the kit hopes to attract repeat clients. This business model will be harmed by any failure to fulfill their commitments; thus, we can expect them to try to keep their word.

An ad for a phishing toolkit that includes templates for brand imitation and assured delivery against certain SEG vendors.

Are Secure Email Gateways (SEGs) Being Attacked More Frequently?

Yes. Unfortunately, it is the quick answer.

Craw Security’s PhishNext, our phishing simulation services platform, which integrates with customers' tech stacks, is how we know this. In order to identify what Microsoft and SEG have missed, we examine mail after it has passed through their defenses. As a result, we have found an increasing number of phishing emails every year.

According to a very famous Phishing Tool Organization’s March 2025 Phishing Threat Trends Report, the number of attacks that got past Microsoft and SEGs increased by 47.3% in 2024.

Additionally, throughout a six-month period, three types of payloads were significantly more likely to evade perimeter detection, according to that particular report:

● 38.8% increase for phishing hyperlinks

● 20% increase in malware

● 14.2% increase for emails that relied solely on social engineering

We also examined the attacks that penetrated five SEGs with the biggest customer footprints for this article. According to our analysis, these products were circumvented in an average of 60.9% of phishing emails with a harmful URL. Business email compromise (BEC) attacks were the most likely to succeed in terms of attack type, with 59.8% of them going unnoticed.

Five Strategies Cybercriminals Employ to Access Secure Email Gateways (SEGs)

Signatures and reputation-based detection are how SEGs operate. To put it succinctly, they use authentication checks and blocklists of "known bad" hyperlinks and malware payloads to determine whether or not something is suspect. Emails are placed in quarantine if they are known to be malicious or if the domain appears suspect; otherwise, they are sent to the inbox.

In the past, SEGs dominated email security in a world that was far less technologically advanced. We all exchanged fewer emails during this period, and phishing assaults were mostly launched from dubious sites, had horrible language and punctuation, and offered millions of dollars to be paid by a long-lost family or foreign monarchy. Therefore, anything in the inbox that wasn't filtered out by a SEG would probably stand out like a sore thumb.

These days, attacks are even more complex, with hackers trying to simultaneously evade detection and trick the recipient into responding to the email. Here are five ways they can accomplish it:

Using compromised accounts	A cybercriminal uses a trusted domain to go past a SEG's reputation checks when they send a phishing email from a compromised but authentic account. Additionally, recipients may be more receptive to emails that appear to have been issued from a firm or brand they trust, or by someone they know.
Leveraging third-party platforms	This usually entails setting up an account on a reliable site and sending attacks using their authorized communication infrastructure. The outcome is the same as when a valid account is compromised due to the sender's domain reputation; however, since the platform has not been compromised, it is as simple as registering for a service. These kinds of assaults, including this campaign that takes advantage of Google AppSheet, have significantly increased in 2025, according to our Threat Labs team.
Ageing the domain	Although creating a new email domain is not too difficult, authentication checks may identify it as a suspect. Cybercriminals can age the domain by just sitting on it until enough time has passed, which increases the site's look of validity. In order to avoid SEG detection, phishing domains were, on average, 3,829 days old, according to our Phishing Threat Trends Report.
Applying technical measures	In order to obfuscate (hide) their true nature from SEG detection, cybercriminals alter the body and payloads of phishing emails. A popular technique for hiding harmful JavaScript code in an apparently harmless HTML attachment is HTML smuggling. It is possible to alter dangerous URLs or divide words or sentences using invisible or Unicode characters. When a URL is redirected, the target is taken to a different website than what the SEG thought the hyperlink was going to. (Some of these strategies are covered in more detail in our paper.)
Creating undetectable payloads	To identify malware payloads and hyperlinks, SEG blocklists must be updated. New zero-day payloads won't be on the list, of course. The rise of crime-as-a-service and GenAI has made it easier than ever for cybercriminals to use new payloads. Cybercriminals try to take advantage of the lag time that exists between a new payload being identified in the wild and these lists being updated for a provider's global client base.

On the other hand, emails might not have a "traditional" dangerous payload (malware or links). A "benign" fake attachment won't appear suspicious, but can be used in invoice fraud, or the body copy of an email can be used to socially engineer a victim into performing a certain activity. Once more, SEG's blocklists won't include this.

How Can Your Organization Be Protected?

You will probably need to strengthen your email security measures in light of these changes.

Quantifying your risk exposure—that is, how many and what kind of phishing emails are getting past your current defenses—is the first step in any cybersecurity endeavor. After you have this knowledge, you can make changes.

AI-powered defenses that can identify a wider variety of phishing assaults, including those that evade SEGs, are offered by Integrated Cloud Email Security (ICES) systems (such as Craw Security’s PhishNext). Additionally, it is significantly more difficult to design attacks that evade ICES detection. Industry experts Gartner advise businesses to employ an ICES device to assist in thwarting sophisticated assaults like those that leverage BEC and GenAI.

These days, the majority of businesses are integrating ICES solutions into their cloud email systems. Many people select a combination of Microsoft and ICES as their two layers of defense because the innate security offered by Microsoft and its SEG greatly overlaps. Some businesses still find value in their SEG (such as journaling capabilities), so they put an ICES solution on top of it.

Stop Advanced Phishing Attacks with Craw Security’s PhishNext

By filling in the holes in M365 and Secure Email Gateways (SEGs), Craw Security's PhishNext offers a fresh take on email security. PhishNext enables you to initiate phishing attacks on your employees so that you can find the weakest links among the manpower who can be the most critical human vulnerability while responding to actual attacks. Simultaneously, PhishNext will also train those affected phished employees with a video training program of “Safe Email Practices” and via other prominent communication channels. In addition, PhishNext assists human resources in stopping sophisticated phishing attacks, enhancing security dynamically, and reacting to threats more quickly. It improves detection, lowers administrative costs, and motivates users to create a more robust security culture.

Moreover, it helps the crucial employees of any target organization with the following aspects:

● Fulfillment of the Educational Gap: Your staff is still the vital last line of defense, even though SEGs (Secure Email Gateways) find it difficult to identify these evasion strategies. Because of this, it is imperative that they be trained to identify these complex strategies. PhishNext mimics these practical evasion strategies, so your team can identify what filters overlook.

● Strengthening Proactive Defense: Knowing how hackers craft phishing emails to evade security measures is just half the fight. What about the other half? Educating your staff to identify what goes unnoticed. By replicating these sophisticated evasion techniques in secure simulations, PhishNext transforms your workforce into a human firewall that thwarts threats that SEGs are unable to identify.

● Highlighting Risk Awareness: These evasion strategies demonstrate that technical safeguards are insufficient on their own. Attackers are specifically creating campaigns to take advantage of the disconnect between user awareness and your email gateway. By educating staff members against the precise methods that circumvent your current security stack, PhishNext fills that gap.

How is Your Secure Email Gateway Affected by Phishing Attacks?

Latest Posts