68% of breaches at companies with 15-80 employees start with email. Here are the specific email security controls that prevent them.
Executive summary: Sixty-eight percent of successful breaches at companies with fewer than 100 employees begin with email — a phishing message, a malicious attachment, or a compromised link. The sophisticated attacks that make headlines are not what threatens your company. What threatens you is a well-crafted email that convinces one person to click one link. Email security at companies with 15-80 employees is typically limited to basic spam filtering, which catches obvious threats but misses targeted phishing, zero-day attachments, and look-alike domain impersonation. This article maps the specific email security controls that close these gaps without requiring a security operations team.
Your biggest security vulnerability does not require an exploit, a hack, or a zero-day vulnerability. It requires an email. One email. Sent to one person who is busy, distracted, or trusting. That is how most breaches begin for companies your size — not with sophisticated attacks, but with convincing messages.
Email is the front door of your business. Every employee with an email address is a potential entry point for attackers. Security awareness training helps — but even well-trained employees click phishing links at a 4-8% rate under testing conditions. For a company with 40 employees, that means one to three people will click a malicious link in any given campaign. The question is not whether someone will click — it is whether your technical controls catch the threat before or after the click happens.
Email security works in layers. Layer one filters known threats before they reach any inbox. Layer two sandboxes suspicious attachments and links in an isolated environment. Layer three detects anomalous sending patterns that indicate account compromise. And DMARC enforcement prevents attackers from spoofing your domain to send phishing emails that appear to come from your company. Together, these layers catch the vast majority of email-borne threats without requiring every employee to be a security expert.
Training is important but insufficient. Humans make mistakes under pressure, fatigue, and time constraints. Technical controls must catch what training misses because one successful phish is all an attacker needs.
Basic spam filters use signature-based detection — they catch known threats. Sandboxing catches unknown threats by executing attachments in an isolated environment and observing their behavior. The gap between these two capabilities is where sophisticated attacks succeed.
Without DMARC enforcement, anyone can send email that appears to come from your domain. Attackers use this to send phishing emails to your clients and partners that look like they came from your company. DMARC enforcement tells receiving mail servers to reject these impersonation attempts.
CPA firm (Financial Services): 147 threats blocked in first 90 days after email security upgrade. After upgrading from basic spam filtering to sandboxed email security with DMARC enforcement, the firm's system blocked 147 threats that would have been delivered to employee inboxes under the previous configuration — including 12 that contained credential-harvesting payloads.
Property management company (Real Estate): $0 fraud loss after DMARC stopped impersonation attacks. Had previously lost $28,000 to a business email compromise where an attacker spoofed their domain to redirect a client payment. After DMARC enforcement, three subsequent impersonation attempts were automatically rejected by receiving mail servers.
| Metric | Before | After |
|---|---|---|
| Email Threats Reaching Inboxes | ~30/month (basic filter) | < 2/month (sandboxed) |
| DMARC Enforcement | None (domain spoofable) | Reject policy enforced |
| Phishing Click Rate | 8-12% (training only) | < 2% (training + controls) |
| Email-Origin Incidents | 2-3 per year | 0 in 12 months |
Every security conversation should start with email. Not because email is the only attack vector — but because it is the most exploited one by a significant margin.
For companies with 15 to 80 employees, 68% of successful breaches begin with an email. A phishing message that harvests credentials. A malicious attachment that installs malware. A spoofed invoice that redirects a payment. Each of these attacks requires only one person to make one mistake.
Basic spam filters compare incoming messages against databases of known threats. They catch the obvious: known malicious senders, recognized phishing URLs, and identified malware signatures. But attackers create new variants daily. A phishing email with a never-before-seen URL passes right through signature-based filtering because there is no signature to match.
This is the gap that sandboxing fills. When a suspicious attachment arrives, sandboxing opens it in an isolated environment and observes its behavior. If the attachment tries to download additional payloads, encrypt files, or establish network connections to known malicious servers, the sandbox catches it — even if the specific file has never been analyzed before.
Layer 1: Pre-Delivery Filtering. Known threats are blocked before they reach any inbox. This includes signature-based detection, sender reputation analysis, and header validation.
Layer 2: Sandboxing and Link Analysis. Suspicious content that passes Layer 1 is analyzed in an isolated environment. Attachments are opened and observed. Links are followed in a virtual browser. Malicious behavior triggers quarantine.
Layer 3: Post-Delivery Protection. If a message is delivered and later identified as malicious — through updated threat intelligence or user reporting — it is automatically removed from all inboxes it was delivered to, even if the recipient has not opened it yet.
DMARC enforcement is the outbound complement to inbound email security. It prevents attackers from sending email that appears to come from your domain. Without DMARC, a phishing email to your client that appears to be from your CFO asking for a wire transfer has a high probability of being trusted — because it genuinely appears to come from your domain.
DMARC implementation requires configuring SPF and DKIM authentication for all legitimate email sources — your mail server, your CRM, your marketing platform — and then instructing receiving mail servers to reject any email from your domain that fails authentication.
The result: your domain becomes unusable for impersonation attacks, protecting both your clients and your reputation.
Part of the Security Hardening insights cluster at JubilantWeb. Reviewed by Nelson Penagos, Founder & Systems Architect. Contact: hello@jubilantweb.com | (407) 630-8771
Spam filtering compares incoming emails against databases of known threats — known malicious senders, known phishing URLs, known malware signatures. It catches threats that have been seen before. Email sandboxing takes suspicious emails and opens their attachments or follows their links in an isolated virtual environment, observing what happens. If the attachment tries to download malware, encrypt files, or contact a command-and-control server, the sandbox catches it even if the specific threat has never been seen before. The difference is reactive versus proactive: spam filtering catches known threats, sandboxing catches unknown threats. Both are necessary because attackers constantly create new variants that bypass signature-based detection.
DMARC is an email authentication standard that tells receiving mail servers what to do with emails that claim to be from your domain but fail authentication checks. Without DMARC, anyone can send email that appears to come from your domain — to your clients, your partners, or your employees. With DMARC enforcement set to reject, receiving mail servers reject these impersonation attempts before they reach the recipient's inbox. You should care because domain impersonation is a common attack vector for business email compromise — where attackers send fake invoices, payment redirect requests, or credential-harvesting links that appear to come from your company. DMARC protects your domain reputation and your relationships with clients who trust email from your domain.
For companies with 15-80 employees, comprehensive email security — including sandboxing, DMARC enforcement, impersonation protection, and URL rewriting — typically costs between $3 and $8 per user per month. For a 40-person company, that is $120 to $320 monthly. Compare this to the cost of a single successful email compromise: average business email compromise losses for companies this size range from $15,000 to $75,000 per incident, and ransomware delivered via email averages $170,000 in total impact. At $200 per month, email security costs $2,400 per year — a fraction of a single incident cost.
Any email security system will occasionally flag legitimate emails as suspicious. Modern sandboxing systems are designed to minimize false positives while maximizing threat detection. The typical false positive rate for well-configured enterprise email security is less than 0.1 percent of total email volume. When a legitimate email is quarantined, the recipient receives a notification and can release it with one click after verifying the sender. The slight inconvenience of occasionally releasing a quarantined legitimate email is trivial compared to the consequence of a single undetected phishing email that compromises credentials or delivers ransomware.
DMARC implementation follows a three-phase approach to prevent email disruption. Phase one: deploy DMARC in monitor mode with a policy of 'none.' This does not block any email — it generates reports showing who is sending email using your domain, including legitimate services like your CRM, marketing platform, and helpdesk. Phase two: review the reports to identify all legitimate email sources and ensure they are properly authenticated with SPF and DKIM. Phase three: move to a reject policy after confirming that all legitimate sources pass authentication. This phased approach takes four to eight weeks and ensures that your newsletters, CRM notifications, and automated emails continue delivering while impersonation attempts get blocked.