The majority of B2B security spending is allocated to visible solutions and email is rarely included. Most firms concluded the issue was resolved once they migrated to a hosted suite and enabled multi-factor login. That represented a genuine improvement at that moment. It also occurred five or six years ago, and attackers’ use of a mailbox has evolved since then.

As the sole platform that reaches every department, email warrants a second look due to its position. An attacker who gains a silent foothold in your inbox can read messages for weeks before taking any action that would trigger an alert. The way a firm manages its mail proves to be a reliable indicator of its overall data handling, and the result is frequently less flattering than the security budget implies.

The gap between logging in and staying private

Multi-factor login answers one question: is this person who they say they are? It says nothing about what happens to a message once it’s sent. Most business email still moves between providers in a form those providers can read, and sits in storage the same way. That is fine for a lunch invitation. It’s a different proposition for a redundancy list or an acquisition term sheet sitting in a thread from 2023.

Canada’s Cyber Centre draws the line clearly in its guidance on email security best practices, which treats privacy and identity as separate problems. Plenty of firms solved the second and assumed the first came bundled with it.

What the breach numbers actually say

The UK government’s 2025/2026 breaches survey put phishing at 38% of businesses, the most prevalent attack type by a wide margin. The sharper figure is buried further in: of businesses that experienced cyber crime at all, 93% experienced phishing. Attackers are not burning budget on novel exploits. They are sending messages, and the messages are working.

Awareness training helps, but it has a ceiling, and the old advice about spotting clumsy grammar stopped being useful once attackers started drafting with the same tools everyone else uses.

Where email fits in data governance

Treating email as an IT concern rather than a governance one is where this usually comes unstuck. A mailbox is a retention question, a disclosure question and a supplier-risk question at once. B2BNN has written about how separate records become far more revealing once they are combined, and corporate mail sits close to the centre of that. Content, contact graphs and timestamps together describe a business more accurately than most of its internal reporting does.

Questions worth putting to your email provider

Ask what your provider can read, not only what it promises not to do with it. Ask where the data sits and under whose law. Encrypted email services answer the first question differently by design. The provider holds no key to the message itself, so the exposure narrows to one clear layer instead of being spread across a contract.

None of this needs a programme or a steering committee. It needs someone senior enough to ask a dull question about a system everyone stopped thinking about, and to keep asking until the answer gets specific.