Email is the Nokia 3310 of business communications: indestructible, compatible everywhere and everyone gets it. And that’s exactly where the problem lies. We continue in 2026 to use a channel designed for an Internet that had “trust” as its main focus. Not identity security, data classification, compliance, or modern attack techniques.
You see the outcome every day: email is not only obsolete as a technology, it is also one of the biggest (and often THE biggest) drivers of data breaches. Both through human error (accidental) and social engineering (intentional misuse). The key message for management/board is therefore not “turn off email,” but: relegate email to mailroom (notification & formal exchange). Move daily collaboration and sensitive information to channels where you can enforce identity, access, logging and data control.
Email is built for delivery, not security
The core of email is the SMTP protocol. The first SMTP standard dates back to the early 1980s. In other words, the foundation of email comes from a time when the Internet was small, academic and relatively “friendly.”
SMTP’s goal was: deliver messages reliably between systems. And not:
- demonstrate that the sender is really who he says he is.
- enforce that only authorized recipients can read.
- maintain control over what happens to data after transmission.
That immediately explains why email structurally clashes with modern security requirements:
- Weak identity layer: “Who” the sender is remains in practice too easy to fake or manipulate (spoofing, lookalike domains, display name tricks).
- Copying machine for sensitive data: attachments and forwarded threads multiply data. You lose grip on where PII, contracts, financial info and internal decisions are floating around.
- No real “withdrawal/expiration” logic: once sent, it’s gone; you can rarely retrieve it reliably.
- Metadata remains sensitive: even if you secure content better, subject lines, recipients, times and often context remain visible, exactly the ingredients that attackers and “leaks by misrouting” run on.
In short, email is an open postcard system that we try to tape shut with policies, plugins and training.
Why email so often ends in data breach
A) The “wrong recipient” leak: the most common data breach
Many data breaches are not spectacular. They are embarrassingly simple: an e-mail with personal data to the wrong “Hennie Jansen,” an autocomplete that goes wrong, a CC/BCC miss, or an attachment that was not intended for that party.
And that’s not marginal. In UK data security incident reporting (Q1 2024) it was explicitly stated that “data emailed to the wrong recipient” was the most common incident type (18% of the total).
That’s why email feels like the main source of data breaches in many organizations: it’s low-threshold, massively used. One small mistake is immediately a reportable incident.
B) Phishing: email as a front door for attackers (now with AI turbo)
Looking at “real hacks,” email has been the favorite entry point for years. Not because email is “so convenient,” but because people simply click, reply, or give away login information, especially if the message is credible.
- The UK Cyber Security Breaches Survey 2025 states that among organizations that experienced a breach/attack, phishing remained the most common and most disruptive category.
- ENISA Threat Landscape 2025 goes even sharper: phishing remained the dominant intrusion vector (60%) in their analyzed incidents. They signal that AI-assisted phishing represented “more than 80%” of observed social engineering activity worldwide by early 2025.
So even if your technical perimeter is fine: email “bypasses” that perimeter via behavior.
C) Business Email Compromise: no malware required, but millions in damages
Business Email Compromise (BEC) is the scenario in which criminals impersonate (via compromise or convincing spoofing) the CEO/CFO/supplier and extract payment instructions or sensitive documents.
The FBI IC3 report for 2024 shows just how big this is: Business Email Compromise stands at $2.77 billion in reported losses and 21,442 complaints in 2024.
Note that this type of attack is so popular because it often does not stand out as “a hack.” It looks like normal business practices (“can you please pay this invoice urgently?”).
D) Example: one phishing email → tens of thousands affected
The ICO describes a concrete example where a phishing email toward an accounts mailbox led to malware installation, lateral movement and eventual encryption/compromise of HR data of approximately 113,000 people (incl. special categories).
This is the pattern in the game: email is the initial “hook,” then escalation follows.
“But we have security on email, right?”
True: MFA, secure email gateways, DMARC, DLP, encryption options, it all helps. But the bottom line remains:
- You are securing a channel designed without a strong identity.
- You secure transmission, not data control. Once info is outside, it gets tricky.
- The attack shifts to conviction. Man remains the target.
Verizon’s DBIR 2025 executive summary highlights that the human element remains around 60% of breaches and that synthetically generated text in malicious emails doubled in the past two years.
In other words, email security is necessary, but not sufficient. You will continue to mop up if email remains the primary collaboration channel.
Why secure file sharing should be a permanent layer in your strategy
The biggest “quick win” toward reduced e-mail risk is often: stop using attachments as the default and introduce secure file sharing as an organization-wide standard.
An enterprise-grade secure file transfer solution should offer minimal:
- Strong encryption / end-to-end protection (in transport and storage)
- Granular access control (roles, rights, explicit recipients)
- Audit trail + compliance reporting (who shared what, when accessed, downloaded, deleted)
- Revoke access + automatic expiry/retention (error sent? instant revoke; links expired)
- Strong identity linkage (SSO, provisioning)
- Allow remote recipients to receive securely (e.g., guest access with 2FA/PIN, depending on policy)
- Data residency / EU hosting if that is a requirement in your risk appetite or contracts
Sowhere Msafe Secure File Transfer fits in specifically : Msafe offers strong encryption, access management, audit trails. Integration options such as Outlook integration, SSO (Microsoft Entra ID) and SCIM. In addition, adjustable expiry/retention and revoke functionality.
This makes the type of solution suitable as an “attachment replacement” in a communications architecture. Email becomes notification/introduction, but the actual file goes through controlled sharing.
Board-level game rules that work
Make it simple (and enforceable):
Email remains ahead:
- first contact with strangers, formal notifications, low-risk messages
No more email:
- personal data/HR, financial records, contract attachments, IP/drawings, security incident details
- payment instructions or bank account changes (always via workflow + out-of-band verification)
Standard: “No attachment external” share via secure file sharing with expiry + logging.
Email remains, but not as primary workplace
The board gain is in an architecture in which secure file sharing becomes the standard for sensitive documents. Because you thereby add control, logging and revoke/expiry at the moment when data is most vulnerable: during exchange. Msafe Secure File Transfer is a concrete example of such an enterprise layer (encryption, audit trails, SSO/SCIM, guest 2FA/PIN, EU hosting/retention settings) that you can incorporate as part of a broader communications strategy.
