Email security filters: what they stop and what still gets through
Email security filters stop the majority of spam and mass malware attacks, but they're nowhere near a complete solution. The filters catch obvious threats through pattern matching and signature detection, yet sophisticated attacks designed for your company, or emails from compromised accounts your team knows, bypass these defenses entirely. You need to understand what filters actually do and what still requires human judgment to stay safe.
What filters reliably block
Email security filters excel at stopping high-volume threats. They identify known malware by comparing file signatures against databases of known dangerous code. They catch spam through reputation systems that track sending IP addresses, domain history, and content patterns. They filter out emails with obviously malicious attachments like executable files or known bad scripts. A good filter will also block messages from domains with poor sending reputation or that fail basic authentication checks like SPF and DKIM records.
The strength here is scale. When a malware variant starts spreading widely, filters learn about it quickly and stop it before it reaches most inboxes. Similarly, spam that targets millions of people gets caught because the volume itself makes it recognizable. These filters handle the noise effectively, stopping thousands of unwanted messages so your team can focus on legitimate work.
Why phishing still lands in your inbox
Phishing emails designed specifically for your company are a different problem. Filters look for known phishing domains and suspicious language patterns, but a well-crafted phishing email can appear nearly identical to a legitimate business message. An attacker who researches your company, uses correct terminology, and mimics the style of real communications from partners or vendors can defeat most filters.
The harder problem is emails from compromised accounts. If an attacker gains access to someone your team knows, emails from that real account arrive without any filter red flag. The sender reputation is clean, the authentication passes, and the content might look normal. The email might say something ordinary like "Can you help with this invoice?" or "Check out this document," which a filter can't distinguish from legitimate requests. Your team has to catch what the filter cannot.
Targeted attacks filters cannot see
Spear phishing aimed at specific people or roles exploits context and trust. An attacker researches your finance manager, learns the names of vendors you work with, and sends an email requesting urgent payment to a slightly altered account number. The message references real projects, uses your company's terminology, and comes with appropriate urgency. Filters have nothing to flag here because it looks like actual business.
Business email compromise (BEC) follows the same pattern. An attacker either spoofs your own company domain or compromises an actual account, then requests wire transfers, sensitive data, or access credentials from employees who have the authority to provide them. Again, the filter sees a normal business email because it is one, technically speaking.
Malware delivered through legitimate file types also bypasses signature-based filters. A Word document with embedded macros or a PDF with a hidden script can execute malicious code without being detected as "malware" because the file itself is a legitimate file type commonly used in business. Modern filters are improving at scanning for malicious behavior inside documents, but they're not perfect.
What your team needs to do
Understand that your email filter is a tool that handles obvious threats, not a security solution that handles all threats. Treat every unexpected email request for payment, data, or access as suspicious until verified, even if it appears to come from someone you know. If a partner or colleague asks for something unusual, verify through a different communication channel before responding.
Educate your team about what phishing looks like, specifically the tactics that actually work: urgency, authority, requests that fit their role, and content that references real business context. Generic warnings about "not clicking links" are less useful than teaching people to pause when a request is unexpected or odd, even if the sender appears legitimate.
Watch for small details that don't quite fit. A slightly misspelled domain, a request for information the sender should already have, an unusual attachment file type, or pressure to act quickly without review are all signals worth stopping for. Filters catch the obviously bad emails. The ones that get through require the human judgment your team provides every day.