4 Dangerous Email Security Myths (And The Reality)

4 Dangerous Email Security Myths (And The Reality)

Email is critical to most companies. It is how we communicate with co-workers, suppliers, contractors, and customers / clients. Without it, much of our business would come to a crashing halt. However, it is one of the areas where we are most vulnerable to cyber attacks and data theft.

Billions of emails are sent every day, many with some soft of confidential, or secure, information within them. And, emails are never a 100% secure form of communication. In fact, when it comes to data theft, email is often the selected intrusion point.

Below are 5 myths about email security (some of which are so pervasive that you may have thought they were true). However, the reality is far different.

The five myths of email security:

  • A Strong Password Is All You Need
  • Email Service Providers Take Care Of Security For Us
  • Trained & Smart Employees Will Obviously Know Better
  • Secure Email Gateways (SEGs) Are Enough

Myth #1: A Strong Password Is All You Need

A password is generally considered strong when it contains a rather long (15 characters or more) combination of uppercase letters, lowercase letters, numbers, and special characters. Even just a few years ago, this was near enough to secure for most email users. However, as email password cracking has become more and more sophisticated (including the use of limited AI to generate passwords more and more inline with what actual humans may choose).

The true answer for today’s world is the use of MFA, or Multi-Factor Authentication. MFA is essentially a multi-step process for logging in that utilizes different types of information for the login steps. One of the most increasingly popular factors in MFA is a biometric login, such as a fingerprint scannner, or facelock on a cell phone.

Myth #2: Email Service Providers Take Care Of Security For Us

Yes, your email provider will help you, often by making the latest security tools available to you, and your team. For instance, GSuite (the paid email service from Google) does provide MFA protection for your entire team, however, if you do not turn this feature on, and train your team in using it, then you do not have this protection.

Relying on your email provider, without ensuring that you are taking the appropriate steps, and taking advantage of the security tools provided to you is a mistake…and in many cases, a very costly one.

Myth #3: Trained & Smart Employees Will Obviously Know Better

It is critical that your team receive detailed training in email security, the policies and best practices that your company has in place for protection, and what to do with potential threats, however, in most cases, this alone is not enough. Phishing and social engineering attacks are becoming more and more sophisticated, and dangerous everyday. Plus, with the amount of data (and the cost of that data in time and wealth) at stake in a cyber attack today, a comprehensive, ever-evolving email security program is the only way to ensure safety.

On average, the cost of a cyber attack is about $3.8 million. And, roughly 90% of all cyber attacks are phishing attacks. If your main security feature is relying on employees to know which links and attachments in the hundreds of emails they receive on a day are safe, you may find yourself in a very dangerous situation sooner rather than later.

Myth #4: Secure Email Gateways (SEGs) Are Enough

An SEG is a critical component of email security, often providing many key aspects of cyber security including:

  • Antivirus
  • Malware Blocking
  • Spam Filtering
  • Content Filtering
  • Email Archiving

However, even with these evolving protections, the rate of phishing attacks does not go down, in fact, it continues to rise. Why? Simple – because it works! In fact, the newest phishing attacks are specifically engineered to hopefully bypass these very basic protections.

The Reality

In reality, your email security needs to take advantage of all of these important attack-stopping tools and tactics. You should be using strong passwords, multi-factor authentication, all of the tools provided by your email providers, a detailed training program for team members, as well as the tools that an SEG provides.

On top of that, you should regularly consult a cyber security expert who can audit your email security on a regular basis, and provide upgrades and improvements to keep your safe going forward as attacks become more dangerous, hard to spot, and costly.

“Gvozden is a tech genius, and always 100% helpful with all of our technical needs here at the school.”

Walaa Horan

Operations Director, Ithaca Montessori School

Find Out Why Business Professionals Trust Xorca For Their Technology Solutions

Xorca Provides…


A detailed analysis of your current IT challenges and situation


An action plan to address your specific needs and for the best ROI


Assistance with policy best-practices  to ensure proper implementation

Get the clarity your organization needs to get your IT back on track. Completely risk-free, with no-obligation.

Get A Free Consultation

Click Here

Do You Need An IT Partner For Your Business?

We are Central New York’s top choice for all of your business’ technology and computer consulting needs 



20+ years of industry experience


Complete Provider

We take care of everything:

  • Network Design
  • Materials Acquisition
  • Installation & Deployment
  • Performance Optimization
  • Security Upgrades


We are dedicated to ensuring that you get the right network with the right hardware for your specific performance and workflow needs


Submit a Comment

Your email address will not be published. Required fields are marked *

Pin It on Pinterest