EMAIL & COLLABORATION SECURITY
Your inbox is where decisions begin. Your shared workspace is where they become action. Protect both—with clearer controls over messages, accounts and the information your team shares.
BEYOND THE INBOX
A supplier changes bank details. A colleague sends a file. A guest joins a project workspace. These everyday actions rely on trust—and an attacker can exploit that trust without sending obvious malware.
Email and collaboration security connects technical protection with business decisions. Filtering matters, but so do account access, external sharing, payment verification and a simple way for staff to report concerns. The aim is to help people work confidently while reducing the paths to fraud, data exposure and disruption.
FOLLOW THE REQUEST, NOT JUST THE MESSAGE
An illustrative attack can move from a familiar-looking message to a trusted workspace and then to a business action. Each stage needs its own checks.
01
A believable sender, polished language or an existing conversation makes the request look routine. AI can make impersonation more convincing; poor spelling is not a dependable warning sign.
The control: Review sender authentication, filtering, links and reporting routes. Treat unusual requests as a reason to verify.
02
The request opens a file, invites a guest or asks for application access. A familiar collaboration platform does not establish that the sender or content is safe.
The control: Check who is sharing, what access is requested and whether the resource belongs to an approved workspace.
03
A payment is approved, credentials are entered or sensitive information is shared. The cost comes from the action, even when the message contained no malicious attachment.
The control: Use independent verification for high-impact changes and make escalation easier than guessing.
Illustrative sequence, not a record of a customer incident.
PROTECT YOUR SENDING IDENTITY
Your business may send mail through its main platform, website, finance software, CRM and marketing tools. Start by identifying legitimate senders and who owns them. A forgotten service can become a delivery problem when authentication policies are tightened.
Review SPF, DKIM and DMARC together. These controls help recipients assess messages claiming to use your domain; they do not prove that every message is safe. A compromised genuine mailbox or a lookalike domain still needs other defences.
Changes should follow a controlled rollout: understand current delivery, validate authorised senders, monitor reports and agree enforcement. Avoid publishing restrictive policies without checking the systems your business depends on.
THREE CONTROLS. DIFFERENT JOBS.
Identifies servers authorised to send for a domain used in the mail transaction. Keep the record aligned with legitimate services and review dependencies when a sender changes.
Uses a cryptographic signature that receivers can verify against a domain’s published key. Confirm that legitimate sending services sign messages correctly and have clear ownership.
Builds on aligned SPF or DKIM results and publishes a handling policy with reporting. Use the evidence to plan enforcement and investigate unexpected sending sources.
Reference: CISA’s DMARC guidance.
COLLABORATION WITH BOUNDARIES
External collaboration should be a deliberate choice. Give teams a practical route to work with clients and suppliers while keeping sensitive material in the right place. A single permissive sharing default can reach far beyond the person who created the link.
For Microsoft 365, review organisation, site and guest settings together. For other platforms, map the equivalent controls rather than assuming the same defaults apply.
RECOGNISE THE DECISION POINT
Choose a situation to explore the risk and a practical response. These are discussion examples, not a diagnostic test.
The message may be genuine, spoofed or sent from a compromised account. Replying to the same email does not independently verify the change.
Use a previously established contact route and your payment approval process. Keep the verification separate from the account-change request.
An attacker can borrow the appearance of a legitimate file-sharing service. A convincing message can lead to a credential prompt or a request to approve access.
Open the approved service through a known route, check the sender separately and report suspicious prompts. Do not approve unexpected authentication requests.
Access may outlive the business reason for sharing. Old links, groups and application permissions can remain even when nobody is actively using the workspace.
Assign an owner to review membership and links at project closure. Remove unnecessary access deliberately while preserving records the business needs.
A useful integration may request broad access to email, files or conversations. Consent can create continuing access beyond a single user action.
Check publisher, requested permissions, business purpose and data handling. Define who approves the connection and how access can be revoked.
THE ACCOUNT BEHIND THE MESSAGE
When an attacker controls an account, messages may come from the correct address and sit inside an existing conversation. Review sign-in protection alongside the settings that let someone read, redirect or act on mail.
Include privileged users, shared mailboxes, delegates and connected applications. Strong authentication helps, but account recovery, exceptions and ongoing permissions also need attention.
Review MFA coverage, unusual resets, risky exceptions and the controls around adding a new authentication method.
Examine unexpected forwarding, inbox rules, delegate access and who can send on behalf of another mailbox.
Review active sessions and applications with ongoing permission. A password change alone may not remove every route back in.
WHEN SOMETHING FEELS WRONG
Staff should know where to report a suspicious message, and what happens after they do. A quick report is useful even if someone has already clicked or replied.
01
Use the agreed reporting mechanism or a trusted contact. If the mailbox may be compromised, use another established communication channel.
02
Record the message, time and actions taken. Involve the responsible IT or security team and preserve relevant evidence before making broad changes.
03
Review affected accounts, sessions, permissions and shared resources. Coordinate changes so critical work and recovery access are considered.
04
Tell the reporter what to do next. Turn the findings into focused improvements to configuration, verification and staff guidance.
A FOCUSED REVIEW, WITH PRACTICAL OUTPUTS
We discuss the platforms you use, who administers them, how you send business email and where collaboration crosses organisational boundaries. Include the workflows that carry the most consequence, such as finance approvals, client documents and remote support.
Agree the systems, evidence and responsibilities before the review begins. Configuration changes and technical testing require a defined scope and a coordinated implementation plan. Your existing IT team or provider can remain part of that process.
The exact deliverables depend on the agreed scope.
QUESTIONS, ANSWERED
Practical answers for the people responsible for communication, collaboration and continuity.
No. Filtering is one layer. Some attacks use genuine accounts, trusted platforms or requests that contain no malicious file. Combine technical controls with sign-in protection, restricted sharing and independent verification of consequential requests.
We can discuss a review of your email and collaboration environment, including Microsoft 365 or Google Workspace. The work depends on the platforms, licences, configuration access and responsibilities agreed at the start. Features available in one plan may not exist in another.
No. DMARC helps receivers evaluate messages claiming to use your domain through aligned authentication. It does not stop every lookalike domain, display-name trick or compromised legitimate account. Payment and access requests still need appropriate verification.
Poorly planned changes can affect delivery. Identify authorised senders, validate their configuration and agree a staged rollout before enforcement. Review business-critical systems and monitor the results with their owners.
Yes—the objective is appropriate collaboration. Define the audience, permissions, ownership and review period for each workspace. Sensitive information may need a more restricted location while ordinary project work continues through approved channels.
Awareness or simulation work should be agreed separately, including audience, timing, objectives and how results will be used. A configuration review does not automatically include sending simulated attacks to your staff.
Use your established incident reporting route promptly, preferably through a trusted channel if the account may be affected. Tell the responsible team what happened and when. Avoid sending credentials or confidential evidence through the website enquiry form.
Start with the platforms you use, approximate user scope, your main concerns and who manages email and collaboration. Mention known delivery or sharing problems. We can discuss the evidence needed after the scope and access arrangements are agreed.
FROM THE RANSOM SECURE BLOG
Build a practical sender inventory before tightening email authentication, so legitimate business messages are part of the plan.
Read article : Before changing DMARC, find out who sends your business emailA practical guide to reviewing audiences, permissions and ownership before a shared workspace becomes a lasting exposure.
Read article : A shared link is an access decision: review it that wayA practical verification process for finance teams facing unexpected payment changes, executive impersonation and convincing voice calls.
Read article : A familiar voice is not approval: checking urgent payment requestsFurther guidance: Microsoft: external sharing in SharePoint and OneDrive. Artwork and scenarios are illustrative.
START WITH THE WORKFLOWS THAT MATTER
Tell us where you need confidence—incoming messages, mailbox access, domain protection or shared workspaces.
