AegisAI Perspectives · 058
The best email security for a manufacturing company judges supplier requests from known senders, pulls bad mail from every inbox and explains verdicts.
The best email security for a manufacturing company checks every supplier request on its content, since business email compromise losses reported to the FBI reached $3,046,598,558 in 20251. A hijacked supplier mailbox signs as itself, so it passes sender authentication24. This page sets out criteria, not a vendor list. AegisAI reads mail through the Microsoft 365 or Google Workspace API after delivery20.
Manufacturing tops the X-Force target list for the fifth year8. The sector accounted for 27.7% of the incidents X-Force observed9. The FBI names Critical Manufacturing among the three sectors most hit by the top 10 reported ransomware variants2.
Manufacturers sit inside other companies' supply chains, and attackers aim at that position. One campaign targeted industrial manufacturing and other companies critical to various supply chains7. More than 80% of its identified targets were in the United States5.
The lures are patient. The attackers first wrote to targets through the Contact Us form on each company's own website4. They then spent days or weeks in professional conversation and often asked the victim to sign an NDA6. A first message that comes through a web form never meets a filter that scores the sender's reputation.
Payment fraud is the other half of the risk. In 2025, businesses reported losses over $30 million to BEC scams involving AI3. For a plant that pays many suppliers each month, one changed bank account is enough.
The architecture decides what the product can see and what it can undo. A secure email gateway (SEG) receives mail through an MX record change and filters it before delivery. An API-based product connects to the Microsoft 365 or Google Workspace tenant and reads mail after delivery, so routing stays as it is.
For a manufacturer, the question is what happens after delivery. A supplier conversation can run for weeks before the fraud request arrives. A product that judges each message once, at the edge, never sees the thread grow. Ask each provider whether it can pull a message back out of every mailbox when a verdict changes.
Test five criteria. Each one ends with a question to put to any provider.
1. Requests from suppliers you already know. Built-in impersonation checks have a blind spot here. User impersonation protection does not work if the sender and recipient previously communicated via email16. A supplier you pay every month has emailed you many times, so its hijacked mailbox falls in that gap.
Question to ask a provider: what does your product read when a known supplier asks to change bank details?
2. Removal and forwarding. A verdict is only useful if the message leaves every inbox it reached. Forwarding rules matter too, since a taken-over account can send copies outside. Turning automatic forwarding off disables Inbox rules and mailbox forwarding that redirect mail to external addresses17.
Question to ask a provider: when you remove a message, does it leave every mailbox, forwards included?
3. Evidence for each verdict. Plant and finance staff need to know why a message was held. Ask to see the verdict on one blocked supplier request and one allowed one from your own mail.
Question to ask a provider: does every verdict say, in plain words, which signal decided it?
4. The identity baseline. A DMARC policy of reject asks receiving servers to reject mail that fails the DMARC check19. For sign-in, the built-in Phishing-resistant MFA strength in Microsoft Entra allows FIDO2 security keys among its methods18. Require it first for admin and finance accounts.
Question to ask a provider: which of these controls does your product read, and which stay with our identity team?
5. Data scope for defense work. A defense supplier must know whether the email security provider will process CUI. Under 32 CFR part 170, a cloud service provider that processes, stores or transmits CUI shall meet the FedRAMP requirements in 48 CFR 252.204-701212.
Question to ask a provider: does your service store message content? Where, and for how long?
These rules apply to the manufacturer, not to a product. This section explains the context so you can scope the questions above. It does not say any email product meets them.
The CMMC Program is designed to ensure defense contractors properly safeguard FCI and CUI on their information systems10. CMMC Level 2 requirements are identical to NIST SP 800-171 R211. The DFARS clause in play is 48 CFR 252.204-7012, which sets the FedRAMP condition for cloud providers that handle CUI.
NIST published Revision 3 of SP 800-171 in May 202413. Its requirements apply to components of nonfederal systems that process, store or transmit CUI14. If CUI travels by email, the mail system is in that scope. So is any service that reads the mail.
ITAR is a separate regime. It rests on Section 38 of the Arms Export Control Act, which authorizes the President to control the export and import of defense articles and defense services15. Ask your export control officer whether technical data moves by email before you choose where mail is stored.
| Criterion | API-based | Gateway | Built-in platform controls | Managed service |
|---|---|---|---|---|
| Known supplier with a hijacked mailbox | Reads the thread and sender history after delivery | Filters each inbound message before delivery | Impersonation checks stop once sender and recipient have emailed | Depends on the tools the provider runs |
| Long lure over weeks | Can read the whole thread | Sees each message once | Depends on settings | Depends on review process |
| Removal after delivery | Removes from mailboxes over the API | Holds mail before delivery | Admin search and purge | Depends on the access you grant |
| Forwarding rules | Needs mailbox access | Not in the mail path for rules | External forwarding can be turned off | Depends on the access you grant |
| Mail routing | No MX change | MX record change | Inside the mail platform | Set by the tools the provider runs |
| CUI scope | Ask where content is stored | Ask where content is stored | Inside your tenant | Ask where content is stored |
The solutions that fit check known supplier requests and remove mail after delivery. They also explain each verdict and state where they keep content. Most manufacturers start with the controls in their mail platform and add one layer for supplier fraud. Test any added layer on your own mail, not on a demo set.
The guide on how to evaluate email security vendors lists trial questions in more depth. For platform detail, see BEC protection for Microsoft 365 and email security for Google Workspace. The inbound email security page shows one API-based approach, and the demo page sets up a test on your own mail.
Do supplier requests to change bank details get their own check, even from known senders?
Is every person who approves payments covered by impersonation protection?
Is automatic external forwarding turned off?
Is DMARC set to reject for your own domain?
Do admin and finance accounts use phishing-resistant MFA?
When a message is removed, does it leave every mailbox, forwards included?
Does every verdict show the signal that decided it?
Do you know whether CUI ever travels by email?
Does your provider state where it stores message content?
Is every bank change confirmed by phone on a number you already hold?
Illustrative example, figures are fictional. A machining plant in Ohio buys castings from the same foundry every month. A foundry account manager's mailbox is taken over. The attacker replies inside a three-week thread about a late order and asks for the next payment to go to a new bank account. Sender authentication passes, because the mail really comes from the foundry. What stops it is a check on the request itself and a phone call to the number already on file.
The guide on how to prevent business email compromise covers the finance controls behind that call.
AegisAI reads mail through the Microsoft 365 or Google Workspace API after delivery. There is no change to mail routing (MX records); it starts read-only and runs in monitoring mode first23. The verdict rests on what this sender has sent you before and on the request itself25. The median verdict takes 1.9 seconds, and a convicted message is removed from every mailbox it reached within seconds21. Every verdict comes with its reason in plain language, so your team can check it and share it22.
Run a trial in this order.
Track three numbers. The first is flagged supplier requests. The second is forwarding rules removed. The third is the time from delivery to removal.
It can support the controls, but CMMC assesses the contractor. The program checks that defense contractors safeguard FCI and CUI. Level 2 matches NIST SP 800-171 R2. If CUI moves by email, ask each provider where it stores message content.
No. A reject policy tells receivers to refuse mail that fails the DMARC check. A hijacked supplier mailbox signs as itself, so it passes sender authentication. The request needs its own check.
Yes, for most tenants. Turning it off disables Inbox rules and mailbox forwarding that redirect mail to external addresses. Allow named exceptions only.
In X-Force data, yes. Manufacturing tops the target list for the fifth year, with 27.7% of observed incidents. The FBI lists Critical Manufacturing among the sectors most hit by the top 10 ransomware variants.
Only in some cases. Part 170 says a cloud service provider that processes, stores or transmits CUI shall meet the FedRAMP requirements in 48 CFR 252.204-7012. Ask whether the provider handles CUI at all.
Start with a DMARC reject policy and phishing-resistant MFA for admin accounts. Add a phone check on every bank change. Then add a check on supplier requests.
