How to Protect Your Company's Email Against Leaks

Corporate email is the most attacked entry point in companies. More than 90% of cyberattacks against organizations begin with an email. And SMEs are especially vulnerable: they usually don't have a dedicated cybersecurity team, but they do have valuable data.

Why is corporate email a target?

• It's the main communication channel — Invoices, contracts, customer data
• It contains credentials — Registration confirmations, password resets
• It represents authority — An email from the company domain seems legitimate
• It's reusable — One compromised account allows internal phishing

Real risks for your company

1. Business Email Compromise (BEC)

An attacker impersonates the CEO or an executive to order bank transfers. Global losses from BEC exceed €2 billion annually.

2. Customer data leak

If an employee's email is compromised, the attacker can access customer data, quotes, contracts, and internal documents. This can mean a sanction from the AEPD under the GDPR.

3. Internal phishing

From a compromised corporate account, the attacker sends phishing emails to other employees. Since they come from a "real" colleague, the success rate is very high.

4. Credential stuffing

If an employee uses their corporate email on external services (LinkedIn, forums) and reuses the password, a breach on those services can give access to the company's email.

Protection plan for your company

Level 1: The basics (free or low cost)

1. Password policy — Minimum 14 characters, unique, with a corporate password manager
2. Mandatory 2FA — For all employees, no exceptions
3. Anti-phishing training — Quarterly awareness sessions
4. Breach checking — Scan corporate emails on SecuryBlack periodically

Level 2: Intermediate protection

5. SPF, DKIM, and DMARC — Configure these protocols on your domain to prevent identity spoofing by email
6. Advanced anti-spam filter — Beyond your provider's basic filter
7. Conditional access policy — Restrict email access from unauthorized devices
8. Permission review — Remove former employee accounts immediately

Level 3: Advanced protection

9. Continuous breach monitoring — With SecuryBlack you can monitor all emails on your domain
10. Phishing simulations — Send simulated phishing emails to measure your team's response
11. DLP (Data Loss Prevention) — Policies that prevent sending sensitive data by email
12. SOC or SIEM — For larger companies, 24/7 security monitoring

Essential configuration: SPF, DKIM, and DMARC

These three protocols are free and protect your domain against spoofing:

• SPF — Defines which servers can send email on behalf of your domain
• DKIM — Digitally signs emails to verify they haven't been modified
• DMARC — Defines what to do with emails that don't pass SPF/DKIM (reject, quarantine)

Your hosting or email provider can help you configure them. It's one of the improvements with the highest impact and lowest cost.

What to do if a corporate email is compromised

1. Change the password immediately and revoke all active sessions
2. Review sent emails — Look for messages you didn't send
3. Notify internally — Warn colleagues that they may have received fraudulent emails
4. Review forwarding rules — Attackers often set up automatic forwarding to their own account
5. Assess the obligation to notify — The GDPR obliges notifying the AEPD within 72 hours if personal data is affected

---

Want to know if your company's emails are already compromised? Check them for free with SecuryBlack.