TL;DR
What Does tThe Data Actually Show About SEG Bypass Rates in 2025?
The most damning evidence against traditional SEGs comes from industry data showing massive increases in bypass rates. In the first three months of 2024, we identified a 52.2% increase in the number of attacks that bypassed SEG detection. This isn't a gradual degradation—it's a systematic collapse of effectiveness.
With 44% of phishing emails being sent from compromised accounts, which help them bypass authentication protocols, it comes as little surprise that 87% of organizations are on the journey to move away from their SEG already. These statistics represent organizations voting with their security budgets against a technology that has proven inadequate.
The AI-Driven Attack Evolution
The sophistication gap between attackers and traditional defenses has widened dramatically with AI adoption. In newer findings, 82% of phishing toolkits mention the use of deepfakes and 74.8% reference AI, reiterating the drastic rise in polymorphic attacks that SEGs struggle to detect.
According to IBM's 2024 Cost of a Data Breach Report, the global average cost of a data breach reached $4.88 million in 2024, as breaches grow more disruptive and further expand demands on cyber teams. This represents a significant increase from previous years, directly correlating with the failure of traditional security measures to adapt to modern threats.
Limitations of Perimeter-Focused Design Flaws
Traditional SEGs suffer from fundamental architectural limitations that make them unsuitable for cloud-based email environments. Many SEGs will route email traffic directed to the corporate email server through a cloud-based proxy for inspection before forwarding it to its destination. SEGs are designed to protect against phishing and other email-borne threats, but their design dramatically limits their effectiveness.
This proxy-based approach creates significant blind spots, particularly the design of the SEG makes it less suited to protecting modern cloud-based email solutions. Material Security addresses this fundamental flaw through its API-native architecture that leverages the rich APIs and audit logs available in Google Workspace and Microsoft 365 to create a cohesive security solution that connects the dots between what traditional point solutions often miss .
Why is a Perimeter-Based SEG aPoor Fit for Cloud Email Like Google Workspace?
The core detection methodology of SEGs has become obsolete in the face of modern threats. One key detection mechanism used by SEG technology is signature-based detection, which can be effective against 'known bad', such as malicious payloads, sending domains and hyperlinks that have previously been identified and are present in definition libraries. While this can be efficient in filtering out frequent attacks and spam mail, the fact the threat must be 'known' can dramatically reduce its efficacy when detecting zero-day attacks, socially engineered phishing emails without a traditional payload, and any hyperlink or domain that is polymorphic.
This limitation is particularly problematic because without any physical payload, purely linguistic and socially engineered attacks are highly likely to bypass signature detection. This is especially true if the attack is sent from a domain not listed on any blocklist, such as a legitimate but compromised account or a spoofed email domain with proper authentication.
The 48% Problem
Perhaps the most damaging trend undermining SEG effectiveness is cybercriminals' strategic shift to using compromised legitimate accounts. In 2024, nearly half (48.3%) of the attacks that bypassed an SEG were sent from legitimate but compromised accounts. This represents a fundamental failure point for reputation-based detection systems that SEGs rely upon.
Whether this is from within the target's own business, supply chain, or a third-party account not linked to their organization at all, a compromised account is highly likely to bypass reputation-based technology. If the attack originates from within the recipient's supply chain, compromised accounts can also ensure attacks bypass any type of social graph detection, as there will be a pre-existing and therefore 'safe' relationship between the two accounts.
Material Security's approach directly addresses this challenge through its comprehensive account takeover prevention capabilities and behavioral analysis that can detect anomalies even when communications originate from trusted sources.
Authentication Protocol Vulnerabilities
The reliance on traditional authentication protocols creates additional vulnerabilities that sophisticated attackers exploit. 20.2% of the phishing emails that bypassed the SEG employed technical measures to avoid detection by Microsoft 365 and SEGs · 68.4% of these attacks passed authentication checks, including DMARC.
This data demonstrates that even properly configured authentication protocols are insufficient against modern attack techniques, highlighting the need for behavioral analysis and contextual understanding that only API-based solutions like Material Security can provide.
The Magic Quadrant Evolution
The release of Gartner's first Magic Quadrant for Email Security Platforms in 2024 represents industry acknowledgment that traditional SEGs are insufficient. The new 2024 Gartner® Magic Quadrant for Email Security Platforms™ has signaled a shift in how we approach email protection. We believe this new Magic Quadrant encompasses a broader spectrum of email security providers to reflect the evolving threat landscape and the need for more integrated products.
Email security has come a long way since the days when secure email gateways (SEGs) were the gold standard. While SEGs effectively block known threats using signature-based detection, they struggle against sophisticated attacks that utilize social engineering and emerging or obfuscated payloads. This gap led to the rise of Integrated Cloud Email Security (ICES) products, which offer enhanced protection by leveraging machine learning and natural language processing to detect the advanced threats that SEGs often miss.
The Forrester Validation
Forrester's research further validates this shift in the industry. The rise of cloud-native, API-enabled email security solutions (CAPES) in 2021 coincided with the rise of extended detection and response platforms hungry for email telemetry. This led CISOs and their teams to look closely at CAPES vendors as cost-effective alternatives to the stalwart secure email gateway (SEG) that could supplement the native capabilities of email infrastructure providers.
The market validation is clear: The emergence of a new email security vendor category (CAPES) and the rush of legacy players to remain competitive means that customers have more choice than ever when it comes to protecting how employees, customers, and partners communicate and collaborate. Often, security and tech leaders are choosing more than one email security partner in a layered or multilayer approach to protection. This was validated by the customer reference calls conducted as part of the evaluation.
The Administrative Burden Crisis
Operational Overhead Reality
SEGs create significant operational overhead that directly impacts security effectiveness. Rule-based protection offered by systems like secure email gateways (SEGs) requires IT teams to set up and maintain manual rules to either block or allow emails based on set criteria. Of the security leaders we interviewed, 100% stated that they were frustrated with systems that rely solely on static DLP rules, citing high administrative burden and constant need for manual updates.
This administrative burden isn't merely inconvenient—it creates security vulnerabilities. Secure email gateways may not be configured properly, or may not be updated frequently enough to keep up with new threats. This can lead to vulnerabilities that attackers can exploit .
Material Security eliminates this burden through automated detection and response capabilities that adapt to new threats without requiring constant rule updates or manual configuration changes.
The Staffing Crisis Connection
The operational complexity of SEGs exacerbates the industry-wide cybersecurity staffing shortage. According to IBM's Cost of a Data Breach Report, organizations faced severe staffing shortages compared to the prior year (26% increase) and observed an average of $1.76 million in higher breach costs than those with low level or no security staffing issues.
How Can You Augment or Replace Your SEG to Stop Modern Email Threats?
Material Security represents a fundamental evolution from perimeter-based security to cloud-native protection. Unlike traditional SEGs that struggle with cloud environments, Material offers a modern, comprehensive strategy that unifies cloud workspace protection across email, files, and user accounts. The platform leverages the rich APIs and audit logs available in Google Workspace and Microsoft 365 to create a cohesive security solution that connects the dots between what traditional point solutions often miss .
This API-first approach provides several critical advantages:
- Real-time visibility: Unlike SEGs that only see email in transit, Material Security monitors all email activity within the cloud environment
- Contextual analysis: Material combines in-depth threat research with machine learning and AI models to effectively detect BEC, VIP impersonation, and other attacks that bypass traditional controls
- Automated response: Built-in workflows detect and automatically apply a range of granular responses to attacks – from speedbumping links and attachments to outright deleting messages
Advanced Threat Detection Capabilities
Material Security's detection capabilities specifically address the limitations that plague traditional SEGs. Material protects against payload-less attacks, identifying VIP impersonations, spoofing, invoice fraud, and more. An enhanced processing pipeline evaluates attachments, links, and QR codes through a multi-stage analysis process for signs of malicious behavior. With built-in detection, abuse mailbox integration, and custom rules, Material's multi-faceted approach detects attacks that bypass Google, Microsoft, and legacy gateways.
Proven ROI and Efficiency Gains
Organizations implementing Material Security report significant efficiency improvements that directly address the administrative burden problems of traditional SEGs. Customer testimonials demonstrate measurable impact: "It used to take me 20-30 mins to investigate a single phishing email. Today I received 5 or 6 phishing emails and spent only 2-5 minutes in Material."
The Financial Impact: Why SEG Failures Cost Millions
The financial impact of SEG failures extends far beyond the technology investment. IBM's latest data shows that stolen/compromised credentials was the most common initial attack vector. These breaches also took the longest to identify and contain at nearly 10 months—precisely the type of attack that SEGs consistently miss.
The cost differential is dramatic: Two out of three organizations studied are deploying security AI and automation across their security operation center (SOC). When these technologies were used extensively across prevention workflows organizations incurred an average $2.2 million less in breach costs, compared to those with no use in these workflows.
Migration Urgency Indicators
Organizations should prioritize migrating from SEGs if they experience:
- Increasing bypass rates: Multiple sophisticated attacks reaching end users
- Administrative burden escalation: Security teams spending excessive time on rule management
- Cloud adoption challenges: SEG performance degradation with cloud email systems
- Staffing limitations: Insufficient resources to maintain complex rule sets
Implementation Best Practices
Based on Material Security's deployment experience across organizations, successful migrations follow these patterns:
- API Integration Assessment: Evaluate current Microsoft 365 or Google Workspace API permissions and policies
- Parallel Deployment: Run Material Security alongside existing SEG initially to demonstrate superiority
- Gradual Transition: Phase out SEG components as Material Security proves effectiveness
- Performance Monitoring: Track bypass reduction and administrative time savings
Conclusion: The SEG Era Is Over
The evidence is overwhelming: traditional secure email gateways are fundamentally inadequate for modern email security challenges. As cybercriminals evolve their strategies, the limitations of legacy SEGs become more apparent. The rise in sophisticated phishing threats like polymorphic attacks, social engineering tactics, and the use of compromised accounts have undoubtedly highlighted the significant gaps in perimeter technology, leading to a notable increase in bypassed attacks.
The industry has responded with clear recognition of this reality. The new 2024 Gartner® Magic Quadrant for Email Security Platforms™ has signaled a shift in how we approach email protection, while 87% of organizations are on the journey to move away from their SEG already.
Organizations continuing to rely on traditional SEGs are not just accepting inferior protection—they're actively increasing their risk profile while imposing unnecessary operational burdens on their security teams. With Material Security providing a proven, cloud-native alternative that addresses every major SEG limitation, the question isn't whether to migrate, but how quickly you can implement a solution that actually works.
Take Action Today
Your secure email gateway isn't just underperforming—it's creating a false sense of security while sophisticated threats systematically compromise your organization. Material Security offers the advanced, API-native protection your cloud workspace requires.
Contact Material Security today to schedule a demonstration and see how our unified detection and response platform can eliminate the vulnerabilities your SEG leaves unprotected.
.png)