The difficulty with email security products

It's hard to innovate in an old, existing market

Disclaimer: Opinions expressed are solely my own and do not express the views or opinions of my employer or any other entities with which I am affiliated.

Photo by Solen Feyissa on Unsplash

I’m going to try something slightly different this week. Instead of talking about a specific company, I’m going to discuss a product category. It might seem rambly as I use this piece to organize my thoughts on the market and think about how this market can evolve/why it’s been hard to evolve.

What is email security?

That’s an interesting question. It’s obviously dealing with the security of emails. However, much has changed in recent years. For context, until recently, most organizations hosted and ran their own email services, but with the emergence of the cloud, organizations have decided to reduce their IT burden by shifting email hosting to the cloud. This is a key change as before emails were entering a company’s network, but now they exist in the cloud.

What does that mean? With the shift, the company no longer has to worry about malicious emails sitting on their own servers. That burden has shifted to the cloud provider, which in this case is Google and Microsoft primarily. As a result, those companies have more email security features in their SaaS offerings and are provided to the customer.

The customer now has to worry about other types of malicious emails. In my mind, there are two main ones: phishing and malware. Most email security is focused on phishing because that’s a low-effort way to steal credentials. Malware is a concern, but as stated earlier, with the increased use of hosted email, the main concern is around its download and execution. With the advancement in endpoint technology, the responsibility of malware has shifted also.

However, with more SaaS and cloud-based applications, emails contain information that might be helpful to address different types of threats. I’ll discuss this more below.

How does email security work?