Case Study • United States

After the Platform Said Delivered: Residual Phishing in a 10-Mailbox Manufacturer

August 2026

Native email security is very good at catching obvious spam. It is not the last word.

This case study reviews real operational telemetry from an anonymous U.S. specialty building-products manufacturer. The company operates an e-commerce storefront and manages daily operations across ten Microsoft 365 mailboxes: shared inboxes for info@, sales@, and accounting@, a handful of named employees, and the owner. Nobody on staff is a security analyst.

Before any data in this file was recorded, Microsoft’s native platform filter (Exchange Online / Defender) had already evaluated, accepted, and delivered every single message into user inboxes.

What follows is what still required a second look—and what happened when a continuous mailbox layer took over.

The Challenge

A ten-person manufacturer represents the size most commercial businesses actually are. They face four structural email security realities:

"Delivered" Is Not "Safe": Gateway filters stop bulk junk, but they miss authenticated impersonation, newly registered domains with clean first hours, and links that turn malicious after delivery.
The Front Door Problem: Attacks do not land evenly. The public info@ address and the owner's personal mailbox absorbed 64.8% of all threat volume, while accounting@ faced invoice-shaped lures (including an E-ZPass toll fraud campaign during peak shipping season).
The Multi-Recipient Clawback Surface: 485 threat incidents fanned out into 826 individual mailbox deliveries. When a phishing email hits multiple inboxes simultaneously, one person deleting it leaves everyone else exposed.
The 21-Second Window: Industry telemetry (Verizon DBIR) shows the median time between an employee opening a phishing email and clicking a malicious link is just 21 seconds. With beginner-level security awareness, relying on human perfection is not a viable defense.

The Solution

Enuclea deployed a continuous mailbox-security layer operating via API directly inside Microsoft 365:

Autonomous Post-Delivery Clawback: Messages are continuously evaluated post-delivery. When an email is confirmed malicious anywhere, the system instantly purges it across all ten mailboxes simultaneously.
Continuous URL & Attachment Sandboxing: Inspected 1,087 live links and sandboxed 58 attachments as threat infrastructure shifted in real time.
Federated Threat Intelligence: Ingested global community detection feeds, identifying 19.7% of threats before local indicators were established.
Exception-Only Human Triage: Handled 97.1% of incidents autonomously, routing only ambiguous edge cases to Enuclea analysts for manual verdicting.

The Results

The second layer turned what would have been a high-risk operational burden into a silent, zero-backlog background process:

Zero Left Open: Analyzed 411 residual threat incidents in 2026 YTD; 399 were quarantined and purged automatically. Backlog stayed at zero through heavy spring campaign spikes (98 incidents in March, 106 in May).
155+ Hours of Triage Labor Saved: Applying the Osterman Research labor benchmark ($27.51 / 23.2 min per phish), autonomous handling prevented 155.4 hours of staff distraction—equivalent to ~$11,100 in labor value.
9.25× Direct ROI on Labor Alone: At Enuclea’s standard rate of $10/seat/month ($1,200/year for 10 seats), labor savings alone covered the cost of the layer more than nine times over.
Catastrophic Risk Shield: Intercepted an estimated 14 live clicks, 8 credential submissions, and multiple BEC wire-fraud lures, shielding against the FBI IC3 $50,000 median BEC loss.

"You do not buy a second security layer because Microsoft is bad. You buy it because being right 99.5% of the time is how a quiet shop gets surprised."

— Enuclea Mailbox Telemetry Finding

1. 2026 YTD Residual Threat Telemetry (10-Mailbox Tenant)

All figures represent malicious or suspicious mail delivered past native Microsoft 365 filtering from January through late August 2026:

Telemetry Metric	Recorded Value	Operational Context
Total Incidents Analyzed	411	Messages delivered by gateway, flagged post-delivery
Classified Phishing	402 (97.8%)	Hostile credential harvesters, BEC, and payload lures
Classified Spam / Graymail	7 (1.7%)	Bulk marketing bypassing initial filters
Verified Safe	2 (0.5%)	Legitimate vendor communications cleared on review
Left Open / Unresolved	0 (0.0%)	Zero unmanaged queue sitting in user mailboxes
Live Links Inspected	1,087	Embedded URLs analyzed post-delivery
Attachments Sandboxed	58	Invoices, statements, and archive attachments
Messages with Live Links	230 (56.0%)	Active URL payloads requiring deep inspection
Lifetime Incidents (since Dec 2025)	485	Total campaigns intercepted
Lifetime Mailbox Placements	826	Total individual inbox clawbacks executed

2. Threat Distribution by Mailbox Role

Threat actors concentrate effort on public contact forms and executive mailboxes:

Mailbox Role	Incident Count	Share of Total	Primary Attack Vectors
Public Info Box (`info@`)	156	38.0%	Web-form scrapes, SEO pitches, fake RFQs
Primary Operator / Owner	110	26.8%	Executive BEC, wire redirection, vendor spoofing
Director / Management	49	11.9%	Authority lures, internal impersonation
Sales Desk (`sales@`)	39	9.5%	RFQ attachments, purchase order lures
Accounting (`accounting@`)	27	6.6%	Fake invoices, E-ZPass toll fraud, ACH updates
Returns / Support	16	3.9%	Customer dispute lures, fake chargebacks
Personal Alias	13	3.2%	Direct personal targeting

3. Economic Analysis: Cost vs. Avoided Risk

Comparing annual protection cost against industry labor and breach benchmarks:

Benchmark / Category	Metric Source	Financial Value	Multiple vs. $1,200/Yr Cost
Annual Protection Cost	Enuclea ($10/seat/mo × 10 seats)	$1,200 / year	Baseline (1.0×)
Triage Labor Saved	Osterman Research ($27.51/phish × 402)	~$11,100	9.25× annual cost
Lifetime Labor Saved	Osterman Research ($27.51/phish × 473)	~$13,000	10.8× annual cost
Median BEC Incident Loss	FBI IC3 Small Business Average	~$50,000	41.6 years of protection
Small-Firm Incident Range	SMB Forensics & Remediation Surveys	$50,000 – $200,000	42 to 166 years of protection

4. Architecture: The Post-Delivery Remediation Loop

graph TD
    A["Inbound Email Stream"] --> B["Microsoft 365 / Defender Gateway"]
    B -->|"Delivered to User Mailboxes"| C["10 Protected Inboxes"]
    C --> D["Second Layer Mailbox API Telemetry"]
    D --> E{"Continuous Threat Analysis"}
    E -->|"97.1% (399) Quarantined Autonomously"| F["Cross-Mailbox Instant Clawback"]
    E -->|"19.7% Federation Threat Feeds"| F
    E -->|"0.7% (3) Human Analyst Verdict"| F
    F --> G["Zero Residual Threats Left in Inboxes"]

Is your email defense relying on human perfection? Start with a baseline conversation to see what is currently reaching your team's inboxes.

Explore Related Resources

Managed IT in Stafford, VA — Monitoring, patching, MDR, and ongoing support
All Services — IT support, network design, and security hardening
Blog — Practical insights on IT, email, and infrastructure
CO-IT Model — Collaborative managed IT for lean teams

Ready To Strengthen Your IT?

Start with a Baseline Conversation Call, email, or send a short note — whichever is easiest.

Managed IT in Stafford See Services

← Back to all case studies