Microsoft found a failure that better phishing detection alone cannot fix: malicious messages were identified, failed sender-authentication checks, and still got through because a business or user had configured an exception. Its November 5 report on July–September 2026 email threats puts the focus on the rules that can overrule a security verdict.
A familiar sender became a reason to allow the message
The research tracked messages claiming to come from business-service domains, including services used for signing documents and exchanging invoices. This was more than a familiar display name: the forged sender identity claimed the service’s actual domain. Microsoft counted about 129 million malicious messages spoofing the tracked service domains during the quarter.
The revealing step came after detection. Many messages were associated with organization-wide or individual-user overrides. For September messages with a recorded security outcome, overrides applied to 63%, mostly at the organization level. That denominator matters: this is not 63% of all email, all phishing, or all Microsoft customers. Nor does the report establish that those recipients opened the messages or lost their accounts.
The distinction is between recognizing a threat and deciding what to do with it. A rule created to keep an expected document-signing workflow moving can grant too much trust to the sender identity an attacker is impersonating. The report describes a policy failure after detection; it does not establish a breach of the impersonated services.
Investigate the delivery decision, not just the logo
For a mail administrator, the useful question is why a suspicious message was delivered. Review the message’s authentication results, the security verdict, and the specific organization or user exception that affected the outcome. Check whether that exception still has a documented business need and whether it covers more senders or traffic than intended. Remove obsolete exceptions and narrow necessary ones through the organization’s change process rather than disabling protection to rescue one legitimate email.
Recipients usually cannot inspect organization-wide rules. If an unexpected signing request or invoice arrives, open the known service independently and check the request there, or confirm it with the sender through an established contact method. Report the suspicious message so IT can investigate its delivery path. A recognizable name in the inbox is not evidence that its sender passed authentication.
Our phishing versus spoofing guide explains the difference between the lure and the forged identity. If a message leads to an unfamiliar domain, a domain reputation check can provide another signal; it cannot authenticate the message or guarantee the destination is safe.
Detection needs an enforceable outcome
The new report concerns observed activity in the third quarter, not a newly disclosed software vulnerability or evidence that every allow rule is unsafe. Its practical lesson is specific: when a detected malicious message reaches an inbox, examine the exception that changed its treatment before concluding that the detection engine missed it.
References
- Microsoft Threat Intelligence and Microsoft Defender Security Research Team. Email threat landscape: Q3 2026 trends and insights. Microsoft Security Blog, November 5, 2026.
