AegisAI Perspectives · 057
Choose email security for a bank or credit union by how it catches a hijacked vendor thread or new forwarding rule, and what it gives your incident team.
Choose email security for a bank or credit union by how it handles a hijacked vendor thread, not by its spam score. Business email compromise shows an exposed loss of $55,499,915,582 since October 20131. This page, from AegisAI, turns the rules banks and credit unions follow into questions for any provider. It sits under the financial services email security hub.
The board reads the results. Each bank shall report to its board, or a board committee, at least once a year on its information security program20. That report covers service provider arrangements and the results of testing. It also covers security breaches and how management responded.
An email security product touches all of those topics. Pick one whose results you can put in that report.
Start with the rule set that applies to you. Banks follow the Interagency Guidelines Establishing Information Security Standards, which list monitoring to detect actual and attempted attacks on customer information systems7. The guidelines do not name a product. Your risk assessment picks the controls.
New York adds its own rule. Part 500 covers any business operating under a charter or license under the New York Banking Law18. It asks for controls that monitor and filter electronic mail to block malicious content17. The page on what NYDFS Part 500 requires for multi-factor authentication on email accounts covers the sign-in side.
Question to ask a vendor: which line of our guidelines does each feature support, and what record does it leave for the examiner?
The scenario that costs banks and credit unions money is a request to move it. The FBI counts 305,033 business email compromise incidents between October 2013 and December 20232. After a takeover, criminals often set mailbox rules to delete key messages and forward mail to an outside account14. The request then comes from a real mailbox, so sender reputation says little.
The guidelines name the human side. Banks are told to consider controls that stop employees giving customer information to people who seek it through fraudulent means8.
Question to ask a vendor: what does your product read when a known vendor or member asks to change payment details, and what does the verdict say?
Forwarding rules are how an attacker stays inside a mailbox. The NCUA advises credit unions to prohibit automatic forwarding of business email to external addresses16. It also says to log changes to mailbox login and settings and keep them for at least 90 days15.
Question to ask a vendor: do you alert on a new forwarding or delete rule, and how long do you keep that record?
Monitoring covers attempted attacks as well as actual ones. For email, that means a record of what was stopped as well as what got through. A product that only shows delivered threats leaves half the picture out of your board report.
Question to ask a vendor: where do we see blocked attempts, and can we pull them for a date range?
Incident notice runs on fixed clocks. A banking organization must notify its primary federal regulator no later than 36 hours after it determines a notification incident has occurred11. A bank service provider must notify the bank as soon as possible when an incident disrupts covered services for four or more hours12.
Credit unions have 72 hours from the time they reasonably believe a reportable cyber incident occurred9. That clock can also start when a cloud service provider or other third party tells the credit union about a compromise on its side10.
Question to ask a vendor: who is our named contact, what do you send us, and in how many hours, when your service is disrupted or breached?
Your response team needs facts it can file the same day. Reporting to the Internet Crime Complaint Center within 24 hours increases the chances of recovering wired funds13. That report needs the message, the reason it was flagged and who received it.
The page on whether the Safeguards Rule requires an incident response plan for a phishing attack shows what such a plan holds.
Question to ask a vendor: can we export one verdict, with its reason and the list of mailboxes it touched, the same hour?
An email security product is a service provider with access to member and customer mail. Each institution shall exercise appropriate due diligence in selecting its service providers4. It shall require them by contract to implement appropriate measures5. Where the risk assessment calls for it, monitoring includes reviewing audits and summaries of test results6.
The 2023 interagency guidance lays out the life cycle from planning and due diligence through contract negotiation and ongoing monitoring to termination19. The page on how a financial firm oversees an email security service provider under the Safeguards Rule works through the same steps.
Question to ask a vendor: which audit reports can we review each year, and what do you keep of our mail?
No filter replaces a call-back. The FBI advises using secondary channels or two-factor authentication to verify requests for changes in account information3. The NCUA says to verify all payment changes in person or on a known telephone number.
Question to ask a vendor: does your verdict tell our payments team to call back, and does it name the request it flagged?
A secure email gateway (SEG) sits in the mail path and filters before delivery. An API-based product connects to the mail platform and acts after delivery. Built-in platform controls and managed services are the other two options. Compare all four on the same criteria.
| Criterion | API-based | Gateway (SEG) | Built-in platform controls | Managed service |
|---|---|---|---|---|
| Hijacked vendor or member thread | Reads the thread and sender history after delivery | Filters each message in the mail path before delivery | Depends on the features your licence turns on | Depends on the tools the provider runs |
| Forwarding and delete rules | Needs mailbox and audit access | Not part of mail filtering | Admin can block external forwarding | Depends on the access you grant |
| Attempted attacks on record | Its own verdict log | Its own message log | Platform logs, where enabled | The provider's case notes |
| Incident notice to you | Set in the contract | Set in the contract | Set by the platform's terms | Set in the contract |
| Evidence for your response team | Verdict with reason, exportable | Message log entry | Platform alert | Analyst write-up |
| Third-party review | Due diligence and contract | Due diligence and contract | Part of your existing platform review | Due diligence and contract |
Does the product judge a payment change from a sender you already know?
Is automatic forwarding to external addresses blocked for every mailbox?
Are changes to mailbox login and settings kept for at least 90 days?
Can you see blocked attempts as well as delivered threats?
Are the features you pay for actually on in your tenant?
Does the contract name who tells you about a disruption, and when?
Can your team file a 36 hour or 72 hour report from the evidence it gives?
Can you export a verdict with its reason the same hour?
Have you reviewed the provider's audit reports this year?
Does every payment change get a call-back on a known number?
Illustrative example, figures are fictional. Harbor Point Credit Union (fictional) gets a reply on a real invoice thread from its card processor at 9:12 AM. The message asks to send the $48,200 monthly settlement to a new account. A forwarding rule to an outside address was added to the vendor contact's mailbox two days earlier. The email product flags the request at 9:12 AM and names the account change as the reason. Payments calls the processor on the number on file at 9:40 AM, and the processor says it sent no such request. The security lead starts the incident record at 10:05 AM, well inside the 72 hour window.
Build the case from the report the board already gets. Put in the incidents your current controls missed and the time it took to gather facts for a 36 hour or 72 hour report. Add the provider review you ran. Size the risk with the FBI count of 305,033 business email compromise incidents.
AegisAI reads mail through the Microsoft 365 or Google Workspace API after delivery, with no change to MX records21. It runs in monitoring mode first, and removal needs write access that your admin grants and can revoke22. Each verdict comes with its reason in plain language24, and the median time from arrival to verdict is 1.9 seconds25. A convicted email is pulled from every inbox it reached, forwards included23.
Track three numbers from day one.
The best fit catches a request to move money inside a real thread. It also watches forwarding rules and gives evidence your response team can file. Then it has to pass your due diligence and contract steps.
The interagency guidelines list monitoring for actual and attempted attacks, plus controls against staff being tricked into giving out customer information. They do not name a product. The institution sets the controls through its own risk assessment.
No later than 72 hours after it reasonably believes a reportable cyber incident occurred. If a third party such as a cloud provider tells it first, the 72 hours can run from that notice.
A banking organization must notify its primary federal regulator no later than 36 hours after it determines a notification incident occurred. Its service providers must tell it as soon as possible after a disruption of four or more hours.
Use a second channel. The FBI advises secondary channels or two-factor authentication for account change requests. The NCUA says to verify payment changes in person or on a known telephone number.
Report it fast. Filing with the Internet Crime Complaint Center within 24 hours increases the chances of recovering funds wired under fraudulent pretenses.
