AegisAI Perspectives · 069
Most do: Gmail and Microsoft 365 built-in filtering stops malware and known bad links, but its impersonation defaults keep AI-written phishing in inboxes.
Most universities do. Gmail and Microsoft 365 filtering catches malware and known bad links, but an AI-written message that impersonates a dean still lands. Gmail's spoofing protections default to keeping it in the inbox with a warning1. AegisAI is one added layer: it reads mail through the Microsoft 365 or Google Workspace API after delivery21. This page is the platform decision inside how to choose email security for universities and K-12.
Neither platform removes impersonation mail by default. In Gmail, every spoofing and authentication setting lists Keep email in inbox and show warning as its default. Quarantined mail goes to admin quarantine, where an admin decides each message3.
Microsoft 365 starts further back. The protection every cloud mailbox gets does not include impersonation protection8. Where Defender for Office 365 adds it, no sender addresses are protected until an admin adds them10.
Impersonation is the common case on campus. Among UK further and higher education institutions that found a breach, 79% reported others impersonating the organisation in emails or online19.
Question to ask a vendor: with our Gmail and Microsoft 365 defaults left as they are, which delivered impersonation messages did your trial find?
Ask what the filter reads beyond the sender and the links, because AI removes the old tells in the text. The FBI says criminals use AI-generated text to appear believable in spear phishing16. They also use generative AI translation to limit grammatical or spelling errors17. A grammar check no longer separates a scam from a real message from the registrar.
The FBI's 2025 report adds that chat generators quickly create official-sounding emails mimicking a CEO or other officials14. IC3 received more than 22,000 complaints reporting AI-related information in 202513. On a campus, the official is a dean or the help desk.
Microsoft 365 inspects the active payload in the body and attachments for malware, and checks links against URL blocklists7. A polite request to confirm a payroll login on a new page gives a payload check little to find. The page on how AI-generated phishing differs from traditional phishing shows the changes in the text itself.
Question to ask a vendor: for a message with no attachment and a link that is not on any blocklist, what does your verdict say the message is asking for?
Check the settings your tenant actually runs, because several protections exist but are off or unassigned. In Microsoft 365, the built-in protections are included for every cloud mailbox and are on by default6. The Standard and Strict preset security policies, though, are assigned to no one until an admin turns them on and adds users11.
In Google Workspace, the Security Sandbox setting is off by default5. Enhanced pre-delivery message scanning slightly delays a suspicious message so Gmail can run additional checks4.
Turn these on first. An added layer should be judged against your best built-in settings, not against an unconfigured tenant.
Question to ask a vendor: will you run your trial after we apply the Standard preset and Gmail's stricter actions, and report only what got past them?
Ask how protection reaches every mailbox, because built-in impersonation lists are sized for a few senior names. Microsoft 365 allows a maximum of 350 users for user impersonation protection in each anti-phishing policy9. That list covers a president's office and a finance team, and it leaves out most of a faculty.
Student mailboxes sit outside that list. Phishing and spoofing was the top crime type by complaint count in the FBI's 2025 report, with 191,561 complaints15. A layer that reads each message for its intent covers a first-year student and a provost the same way.
Question to ask a vendor: does protection depend on a list of named people, or does it read every message to every mailbox?
Ask how a bad message leaves the mailbox once it is found, because built-in clean-up has limits. Microsoft 365 zero-hour auto purge searches only the last 48 hours of delivered email12. In Gmail, a flagged message under the default action stays in the inbox with a warning.
Speed matters more on a campus that is attacked often. Three in 10 UK higher education institutions (29%) experienced a breach or attack at least weekly20.
Question to ask a vendor: when you confirm a threat a day after delivery, which mailboxes do you remove it from, and who is told?
Count who decides on each flagged message, because a warning hands that decision to the reader. By default, Gmail displays warnings and moves untrustworthy emails to the spam folder2. A warning banner on a well-written message asks a student or an adjunct to judge it alone. Gmail quarantine instead moves the decision to an admin, which moves the work to a small IT team.
The load is real: 98% of UK higher education institutions identified a breach or attack in the last 12 months18.
Question to ask a vendor: per week in our trial, how many messages needed a human decision, and what reason did each one show?
The table compares four approaches on the six criteria above. No approach is named by vendor.
| Criterion | Built-in platform controls | API-based layer | Secure email gateway | Managed service |
|---|---|---|---|---|
| Impersonation by default | Warning in Gmail; no senders protected in Microsoft 365 until added | Reads each message for its intent | Rules and lists set by the admin | Set by the tool the provider runs |
| AI-written text with no payload | Checks payloads and links against known threats | Reads what the message asks the reader to do | Checks content in transit by rule | Depends on the provider's tools |
| Settings to turn on | Presets unassigned, Gmail Sandbox off by default | Connects through the platform API, monitoring first | MX records point to the gateway | Provider configures the tenant |
| Students and staff | Impersonation list of up to 350 users per policy9 | Every mailbox in the connected tenant | Every message routed through it | Set by the contract |
| After delivery | Purge window of 48 hours in Microsoft 365 | Removes from every mailbox it reached | Acts before the platform receives mail | Provider staff act on alerts |
| Decisions left to people | Readers judge warnings, admins judge quarantine | Verdicts carry a reason the team can check | Admin quarantine queue | Provider staff review |
Answer each item yes or no with evidence from your own tenant.
Have you set Gmail's spoofing actions to spam or quarantine where you want them?
Have you assigned the Standard or Strict preset policy to every Microsoft 365 user?
Have you added senior leaders and finance staff as protected senders?
Is the Gmail Security Sandbox turned on where your edition allows it?
Did a trial report threats your tuned built-in settings still delivered?
Did any of those threats carry no attachment and no blocklisted link?
Does the added layer cover student mailboxes as well as staff?
Does one removal reach every copy of a message, forwards included?
Does every verdict come with a reason your team can read?
Can your IT team clear the weekly review queue in the hours it has?
Illustrative example, figures are fictional. A university runs Google Workspace for 4,000 staff and 22,000 students. IT moves Gmail's spoofing actions from warning to spam and turns on the Sandbox. A 14 day read-only trial of an added layer then reports 37 delivered messages the tuned settings left in inboxes. Twenty-one ask staff to sign in to a fake payroll portal. Nine, sent to students, offer a paid research job. None carry an attachment. The IT lead confirms 33 and turns on removal in week three.
AegisAI reads mail through the Microsoft 365 or Google Workspace API after delivery, with no change to mail routing. Every message gets the same question: what is it trying to do22? It starts read-only and runs in monitoring mode first, and removal needs write access your admin grants and can revoke25. One bad email is pulled from every inbox it reached, forwards included23. Every verdict comes with its reason in plain language, so your team can check it24.
Track three numbers from the first day, with your built-in settings already tuned.
Most do, once the built-in settings are tuned. Gmail keeps spoofed mail in the inbox with a warning by default, and Microsoft 365 protects no senders from impersonation until an admin adds them. A trial on your own tenant shows what still gets through.
Microsoft 365 checks payloads for malware and links against blocklists, and Gmail moves untrustworthy mail to spam. Criminals use generative AI to limit grammar and spelling errors, so a polished request with a fresh link gives those checks little to find. That message is the case to test in a trial.
It covers every cloud mailbox with built-in protection that is on by default. It does not include impersonation protection, which is the gap a dean or bursar impersonation falls into.
Quarantine removes the reader's decision and hands it to an admin. Turn it on where your IT team can review the queue. Then measure what still reaches inboxes before you decide on a layer.
Yes. Built-in impersonation lists stop at 350 users per policy in Microsoft 365, so students sit outside them. An added layer that reads every message covers their mailboxes too.
