Email Security

Threat Context

Insights from

It is tempting to picture the people behind those breaches as state agencies. A few are. Most are not. They are criminal businesses, run for profit, using email as a low-barrier, high-yield route to initial access, reconnaissance and persistence. The aim is simple: get into an organisation at scale, take money, and move to the next one. That reframing matters, because it tells you what you are actually defending against day to day.

Email is their default for the same reason a burglar tries the back door before the front. It is the most common way in, and it is rarely locked properly. As a keystone of communication, it is also a delivery mechanism for malware, credential harvesting and social engineering, and that risk is rising. From ASD's ACSC data, Australian entities reported double the Business Email Compromise (BEC) attacks of 2023-24.²

With attackers exploiting both trust and technology, Australian businesses are under real pressure to secure their email environments.

The attacker now does the homework for free

What generative AI changed is not whether these attacks happen, but how cheaply they can be run well. An attacker can scan an industry for the right kind of target, profile a named individual from what is public about them, switch to a softer target when the first one holds firm, and write a convincing lure in the right tone. That used to be days of human effort. Now it is automated and close to free, which makes campaigns cheaper, faster and far more believable. Four patterns show up repeatedly in Australian inboxes:

Product Landscape

The Tekspace Cyber Continuum™ ranks 17 of the leading email security vendors on one transparent, measurable spectrum. To build it, we normalised the field down to 39 capabilities and ranked each by its technical depth, so vendors are compared like for like rather than on the size of their marketing claims.

It gives a picture of feature maturity within the space, then maps vendors according to their capabilities. In doing so, we can see which solutions are most likely to achieve the outcomes that Australian organisations prioritise.

Addendum

Credits

In launching this report, Tekspace would like to acknowledge contributions from the following teams and individuals.

References

1. Practice Protect AU (2025), The devil is still in the email: what BEC looks like in 2025.
2. Australian Signals Directorate (2025), ASD Annual Cyber Threat Report 2024-25.
3. Practice Protect AU (2025), The devil is still in the email: what BEC looks like in 2025.
4. SecurityBrief Australia (2025), Email attacks surge in APAC, phishing up by 30% in 2024.
5. Riposte Cybersecurity Consultancy (2025), Phishing threats in Australia's legal sector.
6. Integris (2025), 2025 Integris report: law firms, cybersecurity and AI — what clients really think.
7. VIPRE Security Group (2026), Q1 2026 Email Threat Trends Report (1.8 billion emails analysed; attackers favouring trusted platforms).
8. VIPRE Security Group (2026), Q1 2026 Email Threat Trends Report.
9. DeepStrike (2025), AI cybersecurity threats 2025: how to survive the AI arms race.
10. Abnormal Security (2024), H1 2024 Phishing Frenzy: C-suite receives 42x more QR code attacks than average employee.
11. Abnormal Security (2024), H1 2024 Phishing Frenzy.
12. Riposte Cybersecurity Consultancy (2025), Phishing threats in Australia's legal sector.
13. DeepStrike (2025), AI cybersecurity threats 2025: how to survive the AI arms race.
14. VIPRE Security Group (2026), Q1 2026 Email Threat Trends Report.
15. Australian Signals Directorate (2025), ASD Annual Cyber Threat Report 2024-25 ($80,850 average self-reported cost of cybercrime per business, FY2024-25).
16. Keepnet Labs (2024), Navigating the email security market in 2025 (200+ email security products).
17. Mandiant / Google Cloud (2026), M-Trends 2026 (global median dwell time 14 days, up from 11; initial-access hand-off in as little as 22 seconds).

Scope

Tekspace’s Cyber SaaS Analysis Report 2026 is not an exhaustive survey of every email security product in Australia. Instead, it focuses on solutions that are widely regarded as either market leaders, or strong emerging players.

Feature Granularity Model

At the outset, we aimed to produce an analysis that is both strategic and practical. It needs to be useful to all IT leaders, regardless of how familiar they are with a given product domain.

In doing so, we gave consideration to how products are compared against one another.

Comparison at a superficial level is too shallow and doesn't give insight as to differentiation between products. At the same time, diving into technical minutiae can often mean losing focus of how products are meaningfully different.

As such, we conduct our evaluation at what we call Level 2: The Functional Group.

In doing so, we can consistently assess whether a product's capabilities are more or less likely to help IT leaders achieve their desired outcomes.

Disclaimers

Where commercial relationships exist, we apply the same evaluation criteria we use for all technologies, including tools we do not resell. We recognise the importance of independence in this research, and do not let commercial relationships affect our framework.

Findings reflect our professional judgement at the time of publication, based on the data available to us. Product capabilities and roadmaps change, so organisations should treat this report as a guide to practical decision making, not as a substitute for their own due diligence.

If you have identified errors in this report, or wish to have another product assessed, please contact our team.

Contact our team