Email Security’s ‘Codified’ Approach Struggles Against Novel Cybercrime

Current email security systems, often likened to a static legal code, are increasingly failing to protect organisations against novel cyberattacks, particularly sophisticated business email compromise (BEC) and compromises involving trusted third parties. This traditional ‘codified’ approach, which relies on predefined rules and signatures to detect known threats, is proving inadequate against threats that do not break established protocols but rather bypass them entirely.

The core issue, according to cybersecurity specialists, is that these systems are designed to identify attacks based on what has already happened. While effective against known signatures and deviations from established behavioural models, they are fundamentally blind to new attack methods that a code has not been written to cover. A zero-day exploit, for instance, represents a threat for which no statute exists, allowing it to pass every security check.

Data highlights the scale of this challenge. The Verizon 2026 Data Breach Investigations Report found that breaches involving a third party accounted for 48% of all incidents, a 60% increase in just one year. These attacks often originate from compromised supplier mailboxes, where messages arrive from genuine domains with valid credentials, bypassing authentication checks that only confirm sender identity, not intent.

The FBI’s 2025 Internet Crime Report further underscores the impact, placing business email compromise losses above $3 billion in a single year. Many of these losses stem from messages that broke no security rules because the rules were never written to describe such nuanced attacks.

Shifting from Rules to Reasoning

Cybersecurity experts are advocating for a shift towards email security systems that can ‘reason’ rather than merely detect. This approach draws an analogy to common law, where a judge can reason from principle and precedent to address new situations not covered by existing statutes. Such a system would not just match a case to a stored pattern but apply principles to cases it has never encountered.

A reasoning system could weigh various pieces of evidence, such as the actual identity of the sender, whether the relationship supports a particular request, and the specific nature of the message’s demand. This moves beyond simply identifying a match or a deviation, offering a more transparent and challengeable decision process that cites its evidence.

This does not imply abandoning existing codified defences. Fast rules remain essential for handling the vast majority of straightforward emails. However, for more complex or suspicious messages, a ‘reasoning’ system would provide a more comprehensive assessment. For high-stakes transactions, such as wire transfer requests, vendor banking detail changes, or payroll redirects, human oversight would serve as the ‘court of last resort,’ escalating decisions to the relevant individual for approval.

The effectiveness of an organisation’s email security can be measured by the number of attacks that successfully reach users from trusted infrastructure—such as compromised vendors or genuine notifications exploited for malicious purposes. A high number suggests that current defences are diligently enforcing a code that is simply not equipped to handle the evolving tactics of cybercriminals.