It may surprise you to learn that emails don’t go directly to your inbox. Instead, they first navigate through a protective buffer that scans for harmful content. Over the years, email services—especially Gmail—have transitioned towards simply appending “warning labels” on messages that contain suspicious links or attachments. This method, which could be described as “avoiding the issue,” hasn’t significantly diminished threats. In fact, a staggering 91% of cyberattacks are still traced back to emails. So, what’s the issue?
The DMN Security Bite series is powered by Mosyle, the sole Apple Unified Platform. Our sole focus is ensuring that Apple devices are enterprise-ready and secure. Through our unique integrated management and security approach, we provide state-of-the-art Apple-specific security solutions for fully automated Hardening & Compliance, Next Generation EDR, AI-driven Zero Trust, and Exclusive Privilege Management in tandem with the most efficient Apple MDM available. Consequently, over 45,000 organizations trust our completely automated Apple Unified Platform, ensuring millions of Apple devices are work-ready effortlessly and at a reasonable expense. Request your EXTENDED TRIAL today to discover why Mosyle is your go-to solution for working with Apple.
Let us first examine the current situation.
In a prior Security Bite, I highlighted findings from a study conducted by web browser security startup SquareX, demonstrating the inadequate measures taken by companies to prevent malicious attachments and ensure user safety.
The researchers dispatched various malware samples attached to emails sent via Proton Mail to iCloud Mail, Gmail, Outlook, Yahoo! Mail, and AOL accounts. Notably, successful delivery of emails could leave users susceptible to threats hidden in those attachments.
The table below presents an overview of the results achieved after sending 7 of 100 malicious samples to different email providers, showing whether or not the harmful attachments were delivered. “A failure to deliver an email suggests that malware was detected while the email was processed by the server,” as stated by SquareX’s study.
Image: SquareX
The Dilemma
It sounds obvious that investing in stringent email security features should be fundamental for user protection. However, Ian Thornton-Trump, the CISO at the threat intelligence firm Cyjax, shared with Forbes, “this is similar to questioning a café’s free Wi-Fi why it doesn’t block more cyberattacks.” He elaborated that finding a balance between being free and secure is quite challenging.
Thornton-Trump contends that enhancing email security features “can create significant challenges with false positives, potentially requiring technical support resources to troubleshoot—an expense that could be unsustainable for millions of users on a free platform.”
Additionally, there are voices claiming that email providers are hesitant to invest in measures that could be costly and adversely affect their profitability. Although recently not explicitly designed for spam filtering, updates to iOS 18, iPadOS 18, and macOS 15 promise enhanced categorization and email summaries—thanks to Apple Intelligence—helping minimize clutter and pinpointing important messages.
I am keen to observe whether Apple will incorporate more AI-driven security functionalities into the Mail app. Utilizing Apple Intelligence to better alert users or even automatically eliminate harmful attachments and URLs from emails in real-time could be revolutionary.
I’d love to hear your thoughts. Please tell me you aren’t still using AOL…
About Security Bite: Security Bite is a weekly column focusing on security topics at DMN. Each week, Arin Waichulis provides insights on data privacy, uncovers vulnerabilities, or highlights emerging threats within Apple’s expansive ecosystem of over 2 billion active devices to keep you informed and secure.
: . More.
