Although many UK public sector organisations had already migrated to Microsoft 365 before the COVID-19 pandemic (or at least or had plans in place for migration), a remote-first world has accelerated adoption rates across all industries globally.

This remote-first world has also seen email being relied on more than ever as a core business communication mechanism. In fact, email security research shows 94% of organisations have seen an increase in outbound email traffic since the pandemic began, with one-in-two experiencing growth of over 50%. Employees are also increasingly stressed, tired and distracted, and therefore more prone to making mistakes.

It should be little surprise, then, that 93% of IT leaders acknowledge sensitive data had been put at risk in their organisation due to outbound email in the last 12 months. More importantly, the average rate for data loss was every 12 working hours.

The native security controls in Microsoft 365 are unable to meaningfully mitigate the most common causes of these incidents:

• Adding one or more incorrect recipients, often due to Outlook autocomplete
• Attaching the wrong file(s)
• Forgetting to use Bcc
• Adding unauthorised recipients into email chains
• Sending data to a personal email address
• Lack of security when TLS ‘failed open’ and the sender was unaware TLS wasn’t being used
• Intentionally taking data to a new job or leaking it as a malicious action

Interestingly, it’s actually the inadvertent errors that are causing the most data breach incidents. In the UK, the Information Commissioner’s Office’s (ICO) security trends for the first six months of 2020 show that ‘data emailed to incorrect recipient’ is the top cause of reported incidents and, between was responsible for approximately 50% more incidents than phishing attacks.

Why you need intelligent email security to stop email data breaches in Microsoft 365

There are two reasons we’ve traditionally failed to solve this problem: firstly, legacy DLP technologies and the security controls native to email clients like Microsoft 365 lack the intelligence required to detect and prevent human-activated threats for outbound email; and secondly, training cannot fix the problem of human error.

Legacy DLP solutions are built using static rules. If an email violates the set criteria, actions can be taken, such as blocking its release or automating encryption. Where security and DLP are user-led, we still run into problems because they rely on people to make decisions. You can either take a sledgehammer approach of prompting on everything, which for the vast majority of employees will lead to click fatigue; or you can trust people will always make the right choice when it comes to adding recipients, attaching files and applying security.

Training cannot fix the problem of human error

While training is rightly an integral part of any comprehensive security strategy; on its own, it’s not able to dramatically reduce human error – otherwise we’d have trained beyond it and misdirected emails wouldn’t be the top cause of security incidents!

What can you do to close the outbound email security gaps in Microsoft 365 today?

There are two things that can be done today to help you overcome the issue of outbound email data breaches in Microsoft 365. The first is an audit of your email system to see how big a problem this is for your organisation specifically. Unfortunately, I expect it’ll be worse than you think. As well as detecting misdirected emails with wrong recipients and attachments, this audit should also look for failure to utilise encryption and other policy violations, and times when TLS should had been protecting data but wasn’t.

The next is to upgrade your outbound email security. Advances in contextual machine learning mean that intelligent DLP can detect and prevent human-activated data breaches in ways that legacy solutions simply can’t achieve. They’re able to deeply understand an individual user’s behaviour and relationships to validate in real-time that, yes, this specific email and its attachments are going to the right recipient(s) with the right level of security applied.

Contextual machine learning gives you the opportunity to make security personal and tackle outbound email security incidents in Microsoft 365 in a way you’ve never been able to before, without damaging productivity. Previously you secured your network layer and then you secured your devices. Now, it’s time to use intelligent technology to secure your human layer and keep data secure when emailed from Microsoft 365.