Most of the businesses I speak with run Microsoft 365 or Google Workspace with the native email protection switched on. It does a lot of quiet work. The bulk of the spam, known malware, and obvious phishing never reaches anyone, and their IT teams have good reason to rely on it.
Then an email arrives from a supplier you deal with every week. The name is right, the project is right, and it politely asks you to update their bank details before the next invoice. Nothing in it looks wrong to the filter or to the person reading it. So what are the native filters built to catch, and what gets past them?
Email is still where a large share of the damage starts. About a third of the cybercrime reports Australian businesses made to the Australian Signals Directorate (ASD) in 2024-25 were email compromise or business email compromise fraud. Across all cybercrime, the average self-reported cost per report for a large business rose 219% in a year, to $202,700 (ASD Annual Cyber Threat Report 2024-25).
Mail with nothing to scan
A filter looks for something it can object to: an attachment carrying malware, a link to a known-bad site, or a sender that fails authentication. Much of what does get through carries none of those. The message is plain text, written fluently, built from what the target has said in public, and it often asks for a reply or a payment instead of a click.
AI has multiplied how cheaply this can be done. An attacker can now research a person and write a convincing lure for them with very little human effort. Microsoft's own research found AI-automated phishing emails drew a 54% click-through rate, against 12% for standard attempts (Microsoft Digital Defense Report 2025). The writing has become that convincing, and when the request is only words, there is little in it for a scanner to catch.
The account that is already trusted
The second gap opens once an attacker is already in. Mail moves three ways inside a business: in from outside, between your own people, and out to customers and suppliers. Most filtering attention goes to the first. After a mailbox has been taken over, the dangerous mail travels the second way. It comes from a colleague, on a real thread, from an address that passes every check because it belongs to them.
The attacker can sit in that account quietly for weeks, reading the flow of email and learning how people write, so that the eventual request for money reads like every other message that person sends. Without visibility of that internal flow, the time an attacker can spend there is close to open-ended.
Why a specialist layer sees more
Microsoft and Google are good at this. Email security is also one of hundreds of products each of them runs, and once their teams are split across all of those products, the group focused on email is smaller than the company's size suggests. A specialist runs email security as its main job, and that focus tends to show in the two gaps above.
The architecture has moved on as well. The older approach put a gateway in front of the mailbox and usually meant switching the native defences off. The current approach keeps every Microsoft or Google defence turned on, sits directly behind them, and learns from what they let through. Because it connects to the mail platform itself, it also watches the mail moving between your own people.
Neither layer is foolproof, and there is no foolproof. The difference shows in how much still reaches the inbox.
See it in your own environment
Email is one of the few areas of security where you do not have to take anyone's word for it. In my experience, most IT teams don't have a clear view of how many threats make it through to their users' inboxes. A specialised layer can be connected to Microsoft 365 or Google Workspace in about fifteen minutes and run in monitor-only mode, so the flow of mail is untouched and nobody changes the MX records.
Over the following two weeks it shows which malicious emails reached which inboxes, who is targeted most, and which of those messages the native layer marked as safe. That is the number to have in front of you before any decision: what is getting past today, in your own mail.