I do not think most organisations are ignoring email security. They have filters, policies, awareness training, endpoint protection, and often a secure email gateway that has been in place for years. Attackers know how those controls work.

Their methods increasingly target the gaps around the inspection point. A message may arrive from a compromised account or hide its destination inside a QR code embedded in an image or PDF. Once it reaches the inbox, the user may scan that code on a personal phone and continue beyond the controls protecting the corporate device.

The gateway can therefore be working as intended while the organisation still has blind spots it cannot easily see.

The QR code changes the route of attack

Quishing uses a QR code to direct a user to a phishing site. The objective is usually credential theft, account compromise, payment fraud or malware delivery. However, the route is harder to inspect because the destination sits inside an image rather than a conventional link.

Microsoft’s Q1 2026 email threat research found that QR code phishing volumes rose from 7.6 million in January to 18.7 million in March, an increase of 146% over the quarter. PDF attachments accounted for 70% of these attacks by March, while attacks using QR codes embedded directly in email bodies also rose sharply.

Check Point explains that quishing often moves the interaction from the device receiving the email to another device used to scan it. That device may be personal, outside corporate policy and less visible to the security team. Warning signs can also be easier to miss on a smaller screen, especially when the destination resembles a familiar sign-in page.

Email security needs more context

A secure email gateway remains a useful control. It inspects mail as it enters or leaves the organisation and can filter spam, quarantine suspicious content and block known threats. Its view is still shaped by where it sits in the mail flow and what it can analyse at that point.

Gartner’s 2025 Magic Quadrant for Email Security says buyers should consider complementary or supplemental email security solutions when addressing modern threats. Earlier Gartner research also noted that traditional gateways are increasingly augmented, and sometimes replaced, by API-based cloud email security deployments.

An API-connected cloud layer can add a different view. Depending on the platform and configuration, it can analyse messages already delivered to mailboxes, use identity and communication context, identify threats after delivery and extend visibility into collaboration or file-sharing activity.

AI has a role here, although the label alone tells us very little. The useful capability lies in combining more context with continued analysis. A suspicious message may look harmless in isolation, while its relationship to the sender, recipient, previous communication, login activity and wider campaign behaviour tells a different story.

Test the environment you already have

Uncertainty often leads organisations to add another product or begin a replacement project. A better starting point is to establish what the current environment is missing.

The Cloud Crew’s complimentary two-week email security assessment reviews live email activity through a cloud-based security layer without changing existing MX records or disrupting mail flow. Once the necessary access has been authorised, the assessment can be applied to Microsoft 365 or Google Workspace while current protections remain in place.

The resulting report is designed to show phishing and quishing messages that reached inboxes despite existing controls, along with post-delivery malware, sensitive-data exposure, connected third-party platforms and the users facing the greatest attack pressure. Findings can also be broken down by platform, enforcement action, department and user, giving the security team evidence it can work with rather than a generic risk score.

Evidence from the organisation’s own traffic is more useful than another claim about what a product should catch. It allows the security team to see what is passing through, where exposure is concentrated and whether the remaining risk is acceptable.

The assessment should not become a disguised rip-and-replace exercise. Its purpose is to test the current architecture, identify blind spots and decide whether the gateway needs augmentation. The findings may confirm that current controls are performing well or reveal gaps around quishing, post-delivery response, data loss and connected applications.

A question worth answering

Email security decisions are often made during renewals or after an incident creates pressure for immediate action. A two-week assessment allows for an evidence-led conversation before either of those moments arrives.

It can show which people or departments are targeted most often, where threats are being detected and which parts of the environment need closer attention. IT and security leaders then have a firmer basis for deciding where to strengthen coverage and how to direct the next part of the security budget.

Even when the gateway is doing exactly what it was designed to do, the organisation still needs enough visibility to know what it missed.