Microsoft’s May–July 2026 telemetry benchmark compares real-world results from Microsoft Defender plus seven Integrated Cloud Email Security add-ons. The data clarifies what baseline cloud filtering handles, where it leaves gaps, and which add-on delivered the largest incremental protection in live tenants.
Microsoft Defender blocks the bulk of commodity spam, mass phishing and known malware, but evasive, payload-free attacks often bypass baseline filters.
KnowBe4 Defend led all seven measured ICES add-ons across Microsoft’s uplift metrics, catching substantially more dangerous mail that Defender missed and performing the largest post-delivery clean-up.
Low overlap with Defender is an important metric: it shows an add-on is finding net-new threats rather than duplicating existing detections.
Blog / Email Security / What Microsoft's Latest Email Benchmark Proves About Defense-in-Depth. Reiner, MBA | Sep 25, 2026 Tweet Let's face it: inertia is often the most common yet most dangerous adversary when it comes to acquiring new technology, especially in cybersecurity. There is still a persistent assumption across many organizations that email security architecture that worked three years ago is still good enough for today's threat landscape.
Even when security teams suspect gaps, the friction of evaluating, procuring and operationalizing new technology creates a massive organizational bottleneck. Because these attacks contain no malicious attachments or known-bad links, static inspection has nothing to detonate. KnowBe4 Defend caught 3.7 times more dangerous emails that slipped past Microsoft Defender than the average add-on.
This report strips away marketing hyperbole and measures what security tools actually catch inside live production tenants. Native cloud defense has matured significantly. Evasive, payload-free attacks demand specialized behavioral AI.
Windows systems are the backbone of most IT environments, running critical applications and enabling distributed workforces worldwide. Yet many organizations still rely on reactive security: patching after breaches occur and investigating threats only after alerts fire, adding cost and regulatory exposure. As an IT man
Lee Martin explores why security awareness programs need to move beyond measuring activity and risk to focus on whether employees are actually getting better at recognizing and responding to phishing. Cofense’s approach to Secure Behavior Management connects measurable employee competency with real-world phishing and r
Introduction Security teams have gotten pretty good at testing against what can hurt them. Can this EDR agent catch this payload? Will my organization fail the phishing simulation? Does this SIEM rule fire on this particular technique? And, in more mature organizations, this testing happens continuously rather than as
Once a Marine, always a Marine. That’s certainly true for Doug Pierson, a recently retired US Marine Corps Major General who manages our Microsoft Executive Support Team. As part of that role, he works with our company’s senior leaders and created an Executive Cyber Defense service offering to assist them with protecti
Threat actors are using phishing emails with blank SMTP sender fields to bypass Microsoft 365 security filters, according to researchers at ReliaQuest. Microsoft 365 Exchange Online uses a feature called “RejectDirectSend” to block unauthenticated Direct Send emails from an organization’s trusted domain. If an attacker
KnowBe4 Threat Lab has published new research uncovering 29,785 confirmed phishing emails abusing Microsoft 365’s Direct Send functionality across July and August 2026. Direct Send is a legitimate Microsoft 365 feature designed to allow devices such as printers and scanners, as well as legacy applications, to send emai
Loading more related stories...
Open the app view to save this story, compare related coverage, and continue from the same source.