Most attacks don't break in.
They arrive in the inbox.

Most attacks on a business don't start with someone breaking through a firewall. They start with a message that looks completely ordinary — an invoice from a vendor you actually use, a shared file notification, a short note from the owner asking someone in accounting to take care of something quickly.

The dangerous ones often have no malware in them at all. No attachment to scan, no link to check. Just a believable request from a name your team recognizes, sent from a domain that's one character off. Filters built to catch spam and known-bad files have very little to say about a message like that.

AllTech puts real filtering in front of your mail, hardens the tenant behind it, and reviews what's actually reaching your people — so the messages designed to look normal get caught before someone acts on one.

Most of what arrives is legitimate business mail, and most of what's filtered is ordinary spam nobody would have fallen for. The messages worth talking about are the ones written to be believed. A few examples of what that looks like:

Microsoft 365 and Google Workspace both include filtering, and it does real work. Bulk spam, known malware, and mail from senders with a bad reputation get handled without anyone thinking about it. We keep all of that running.

The gap is in the attacks built to look ordinary. A message with no attachment, no link, and no malware — sent from a domain registered two days ago, matching the display name of someone the recipient trusts — doesn't look like a threat to a filter tuned for known-bad content. It looks like email.

We can put a number on that from our own mail. Of the 642 malicious messages caught in a recent 31-day window, the report found 108 with a malicious link and just 6 with a malicious attachment. The rest carried no link, no attachment, and no known-bad file — just words, from a name someone recognized.

The threat types line up with that. The most common was plain scam content, followed by identity deception and brand impersonation — attacks that work on the reader, not the machine. Over the same month, 204 messages were flagged specifically as impersonation attempts against people on our own staff, about seven a day. Content scanning doesn't catch those. What catches them is knowing who normally emails your organization, from where, and what a message from them usually looks like.

There's a second gap inbound filtering can't close at all. Once credentials are stolen, the attacker is sending from a real mailbox on a trusted domain, and inbound filtering has no opinion about them. That's why email security has to include what's behind the mailbox: multi-factor authentication, conditional access, and someone regularly checking for the forwarding rules and sign-in patterns that show an account has already been taken.

We don't claim to stop every phishing email. Nobody can, and a vendor who tells you otherwise is selling something.

Filtering is one layer. It works best alongside multi-factor authentication (so a stolen password isn't enough), conditional access (so sign-ins from places your team doesn't work get blocked), security awareness training (so the ones that land get reported instead of clicked), and endpoint monitoring (so an attachment that opens doesn't get far).

The single highest-value thing isn't technical at all: a rule that no change to banking or payment details is ever accepted by email alone. Someone calls a known number and confirms it out loud. That one habit stops the most expensive attacks we see.

Our goal isn't a promise that nothing gets through. It's fewer attempts reaching your team, a harder target behind the mailbox, and a fast, honest response the day something does.