AegisAI Perspectives · 139
For targeted executives, the best email security judges each message on what it asks and on the sender's history with you, not on authentication alone.
See it on your own Google Workspace or Microsoft 365 tenant. No MX change.
Or get the Q3 2026 State of the AI Attack report (free, instant download)
Not ready for a demo? Check your domain (free, about 10 seconds).
The best email security for targeted executives judges what each message asks for and who is asking, because a lookalike domain with valid DNS records can still pass sender authentication5.
AegisAI investigates every email for what it is trying to do, and removes the ones that fail from every mailbox they reached22. If you run IT for a company of 20 to 500 people on Microsoft 365 or Google Workspace, with a small IT or security team and no SOC, this page gives you the criteria and the settings for your named executives. The product side is on the phishing prevention page. AI-written spear phishing in general is covered in how to choose email security that stops AI-generated spear phishing. Consent and lure rules for an executive test are in how to run an AI spear phishing test on executives safely. This page covers the executive group only: what the tool must read, what to switch on, and how to test it.
Key takeaways
- Microsoft 365 protects at most 350 users from impersonation in each anti-phishing policy1.
- No sender addresses are protected from impersonation by default4.
- Mailbox intelligence does not work if the sender and the recipient have written to each other before3.
- The Priority account tag fits at most 250 users10.
- Gmail's spoofing settings keep the email in the inbox with a warning by default14.
| Question | Answer | Source |
|---|---|---|
| For executives being targeted by convincing spear phishing, what email security is best? | A layer that judges each message on the relationship, the request and the sender's history, on top of the platform's executive impersonation settings | 2124 |
| How many executives can Microsoft 365 protect from impersonation? | Up to 350 users per anti-phishing policy. The Priority account tag fits up to 250 users | |
| Is any executive protected by default? | No. No sender addresses are set for impersonation protection by default | |
| What does Google Workspace offer for executives? | Settings for employee name spoofing and lookalike domains, plus a check on unauthenticated mail. The default action is a warning in the inbox | 111213 |
| What still gets through? | A lookalike domain with valid DNS records, and a sender the executive has written to before |
Write the names of the executives you will protect before you change a setting.
Short on time? Watch the explainer, or book a demo.
Business email compromise losses reported to the FBI's IC3 in 2025 were $3,046,598,55815.
Name the people whose approval moves money, and treat them as the protected group.
Traditional phishing sends one lure to many people. Executive spear phishing writes one lure for one person, in the voice of someone they trust. The FBI notes that chat generators can quickly write official-sounding emails that mimic a company's CEO or other officials18.
A targeted request often has no link and no file, so a filter that scores links and attachments has nothing to score. The sender can also pass authentication: a lookalike domain with valid DNS records passes the checks.
Stop treating a passed authentication check as proof that the request is real.
The FBI's IC3 reports that in 2025, businesses reported losses over $30 million to BEC scams involving AI17.
AegisAI reports that AI-generated spear phishing evaded NLP content filters 93.9 percent of the time, at an average length of 562 words25.
Assume every lure to an executive will read as well as a real email, and judge it on what it asks.
Tools that read three things on every message to an executive: the relationship, the request, the sender's history. A filter that only scores links and files has nothing to score in a plain text request from a known contact.
Ask every tool you test which of these reads it makes, and ask for one example verdict that shows it.
Switch on the platform's executive settings first, then add the layer that reads the request.
List the named executives and their assistants, then add anyone who approves payments. Keep the list at 250 or fewer, the cap for the Priority account tag.
Add them to user impersonation protection in an anti-phishing policy. No senders are protected until you add them, and each policy holds 350.
Turn on mailbox intelligence and the first contact safety tip in the same policy6.
Tag the list as priority accounts. Priority account protection is on by default with Defender for Office 365 Plan 29.
In Google Workspace, turn on the employee name setting and the similar domain setting. Change the action from the default warning to Quarantine for executive mail.
Move every executive to phishing-resistant MFA. Codes and push approvals do not count: NIST states that OTP authentication and out-of-band authentication are not phishing-resistant19.
Add a layer that reads the request and the sender's history, and run it in monitoring mode on the executive group first16.
Finish steps 1 to 5 in one change window, so the test starts from a known baseline.
| Setting | What it does | Limit or default | Source |
|---|---|---|---|
| User impersonation protection (Microsoft 365 anti-phishing policy) | Flags senders who pose as the users you list | 350 users per policy; no senders set by default | |
| Mailbox intelligence (Microsoft 365) | Learns each user's email patterns with frequent contacts | Does not work if the two have written before | |
| First contact safety tip (Microsoft 365) | Warns on the first message from a sender, or from a rare one | Shown to the recipient | |
| Priority account protection (Defender for Office 365) | Adds heuristics tailored to company executives | On by default with Defender for Office 365 Plan 2 | 8 |
| Priority account tag (Microsoft 365) | Marks the users priority protection covers | 250 users at most | |
| Protect against spoofing of employee names (Gmail) | Checks a sender's name against names in your directory | Default: keep in inbox and show warning | |
| Protect against domain spoofing based on similar domain names (Gmail) | Checks for domains that look like yours or your aliases | Default: keep in inbox and show warning | |
| Protect against any unauthenticated emails (Gmail) | Requires SPF or DKIM, and shows a question mark next to the sender | Default: keep in inbox and show warning | |
| Phishing-resistant MFA (identity layer) | Protects the executive's sign-in if a lure works | OTP and out-of-band methods do not qualify |
Copy this table into your change log and write the date each row was switched on.
AegisAI catches fake executives, vendors and payment requests, even with no link or file to scan7. Authentication passes, so it does not rely on it. The verdict rests on what this sender has sent you before and on the request itself.
Illustrative example, figures are fictional: Harrow Lane Capital (fictional) has 90 people on Microsoft 365 and one IT lead. It has five executives with two assistants. The IT lead adds all seven to user impersonation protection and the Priority account tag. She then runs a 30 day approved test on the group with four scenarios: a lookalike domain posing as the CEO, a display name spoof, a payment change from a real supplier's hijacked account, and a sign-in lure. Impersonation protection flags the lookalike and the display name spoof. Mailbox intelligence stays silent on the supplier thread, because the CFO has written to that supplier for two years. A second layer in monitoring mode flags the supplier message for its new bank details. The log shows 3 of 4 caught, 1 missed (the sign-in lure, reported by an assistant), and 2 false positives on board mail.
Run the same four scenarios on your own executive group, under the rules in the linked test guide.
Track three numbers for the executive group only, each from a log you can export.
To compare a second layer on the same 30 days of executive mail, start a monitoring-mode trial. Put the three counts side by side on day 30 and decide on them.
Email security that judges each message on what it asks and on the sender's history with you, on top of the platform's executive settings. AegisAI reads the thread the way an analyst would: the sender's history, the change being asked for, and where the reply actually goes. Test any choice on the executive group in monitoring mode first.
Up to 350 users in each anti-phishing policy. The Priority account tag fits up to 250 users. Start with named executives and their assistants, then payment approvers.
No. Mailbox intelligence protection does not work if the sender and the recipient have written to each other before. A hijacked supplier thread needs a check on the request itself.
By default it keeps the email in the inbox and shows a warning. The setting checks the sender's name against names in your directory. Choose Quarantine for executive mail.
Yes. A one-time code does not stop a lure that asks for it: NIST states that OTP authentication is not phishing-resistant. Use a method bound to the sign-in page, such as a security key.
