Sender reputation isn't a simple binary switch, but a nuanced spectrum of behavioral signals that helps build a more accurate, risk-aware approach to email security.
Every email security program answers the same question millions of times a day: should you trust the person who sent this message? It reads like a database lookup. Known sender, let it through. Unknown sender, take a closer look. Clean, binary, done.
The trouble starts the moment you try to make that lookup actually work. Trust is not a fact you can retrieve. It is a judgment you have to construct, from incomplete evidence, about a sender who may be brand new, may be impersonated, or may have been perfectly legitimate right up until the moment their account was compromised.
At Material, we’re continually scrutinizing and refining how sender reputation plays into broader threat detection, and this piece gives a brief overview of how, and why.
Have we seen you before?
The first instinct is almost always the right place to start: has this recipient, or this organization, ever heard from this sender before? A first-time sender is inherently more suspicious than one you have exchanged hundreds of messages with. We built heavily on this signal, and for good reason. Sender novelty is cheap to compute, intuitive to reason about, and remarkably effective at narrowing the field. Most of the mail that matters for phishing detection comes from senders the recipient has never engaged with. If you can reliably separate the never-before-seen from the familiar, you have done a lot of useful work with very little.
For a while, that heuristic carries you. It accelerates rule development, keeps false positives down, and gives analysts a fast, legible reason to escalate a message. The problem is not that it is wrong. The problem is that it is a single bit of state, and single bits of state are easy to flip.
Where the heuristic breaks
Put yourself in the attacker's position. You have compromised an account or stood up a lookalike domain, and you know the target scores inbound mail partly on whether the sender is new. Defeating that check does not take sophistication. It takes patience. Send one unremarkable message a day ahead of the real attack, something no one will think twice about, and the sender is no longer new. Every message that follows sails through the part of the logic that was doing the heavy lifting.
This is the uncomfortable part of relying on a novelty signal: the miss is completely invisible until someone gets hurt, and it is hard to explain after the fact. The sender genuinely was not new. The system worked as designed. The design was just too easy to game.
There is a subtler failure too. "New" versus "not new" throws away everything in between. A sender you received a single newsletter from six months ago and a colleague you email daily both land in the same bucket the instant they clear the novelty window. Collapsing a rich, continuous notion of familiarity into one boolean discards most of the signal you actually have. It is coarse in exactly the situations where precision matters most.
Reputation is a spectrum, not a switch
The fix is conceptually straightforward and operationally involved: stop treating sender trust as a gate and start treating it as a score. Not "trusted or not," but where a sender falls along a range, from completely unknown, to recognized but unremarkable, to genuinely familiar, to actively suspicious.
That shift sounds academic until you see what it buys you. A continuous view lets a detection weigh sender reputation against everything else in a message instead of short-circuiting on it. A borderline sender with a suspicious attachment gets scrutiny that a well-established sender with the same attachment might not. Nothing gets a free pass simply because it aged past a threshold, and nothing gets condemned simply because it showed up for the first time. The signal informs the decision rather than making it.
Getting there means computing reputation from many signals at once, each of which tells you something slightly different, and none of which is trustworthy on its own.
The signals that actually tell you something
The useful signals are rarely the obvious ones, and the most interesting are often about relationships rather than the sender in isolation.
Prevalence is a good starting point: how common is this sender across the environment? A domain that reaches a handful of mailboxes behaves very differently from one that reaches thousands, and outliers in either direction are worth noticing.
Engagement is stronger still, because it is hard to fake. Has the recipient accepted a calendar invite from this sender? Traded several messages back and forth in quick succession? Shared something sensitive with them? These are the fingerprints of a real working relationship, and they are far more expensive for an attacker to manufacture than a single benign email.
Some signals are almost counterintuitive. Whether a sender's address appears in known breach corpora, for instance, is not necessarily a red flag. It can be the opposite. An address that has been floating around the internet for years is more likely to belong to a real, long-lived human being than a freshly minted throwaway. Read the right way, exposure becomes evidence of authenticity.
And prior history matters, with two important caveats. A sender's past verdicts, safe or malicious, should decay over time, because a domain that was clean last year tells you less about today than one that was clean last week. And a sender's record has to account for corrections: when an analyst overrules the system and marks a message safe, that judgment should feed back into the sender's reputation rather than being ignored. Reputation that cannot be corrected is reputation that slowly drifts away from reality.
None of these signals is decisive alone. Each has a failure mode a determined attacker can exploit. The value is in combining them, so that beating the system requires defeating many independent signals at once instead of flipping one.
Getting it wrong is expensive in both directions
There is a temptation to treat this as a pure recall problem: catch more, miss less. But the cost of a mistake is not symmetric, and it is not always in the direction you would expect.
A missed attack is the obvious failure. The less obvious one is over-flagging a legitimate sender, and for some messages, in some inboxes that is nearly as damaging.
A support queue or a sales alias exists to receive mail from people it has never heard from. Treat every unfamiliar sender there as a threat and you have not secured anything; you have broken the mailbox.
Good sender reputation has to hold both failure modes in mind at once, which means every gain in what you catch gets weighed against what it costs you in false positives. There is no setting that eliminates both. There is only the tradeoff: made deliberately, monitored obsessively, and refactored when needed.
Trust is a judgment, not a lookup
The reason sender reputation is hard is the same reason it is worth doing carefully. Trust is not a property of an email address. It is an evolving assessment of a sender's behavior, relationships, and history, and it changes the moment any of those change. A perfectly reputable account is one compromise away from being the most dangerous sender in your environment, and the address itself will not have changed at all.
That is why we treat sender reputation as a living score rather than a one-time gate, and why we treat it a craft to continually refine rather than a box that gets checked. The simple version of the question, have we seen you before, was a good place to start. It was never going to be the whole answer. The senders worth worrying about learned how to answer that question a long time ago, and the work of email security is staying ahead of what they learn next.
