Email security is the practice of protecting email accounts, messages, and attachments from unauthorized access, tampering, and loss. It covers three jobs: keeping attackers out, stopping sensitive data from leaving, and controlling the sensitive data that is already sitting in mailboxes.
Most email security programs were built for the first job. Spam filters, secure email gateways, and domain authentication all decide whether a message should be delivered. Those controls still matter. They just answer a narrow question: is this email safe to receive? They do not answer what is inside it, who can read it later, or where it goes next. That second set of questions is what email DLP and data discovery and classification answer.
An inbox is not a pipe. It is a searchable archive of every invoice, contract, patient form, and password reset your company has ever handled.
That changes the threat model in three ways. It is permanent: a message delivered in 2019 is still readable today by anyone who gets into the account. It is two-way: customers send you regulated data you never asked for, and your staff send data out to the wrong people. And it is shared: OAuth apps, CRM sync tools like Salesforce and HubSpot, and AI assistants now read mailboxes on a user's behalf.
Email also does not stay in email. An attachment gets saved to Google Drive, SharePoint, OneDrive, or Box, pasted into Slack or Microsoft Teams, or forwarded into a Zendesk ticket. A gateway inspects mail at the door. A breach happens in the room. That is why email security in 2026 needs data controls next to the threat controls.
Publish SPF and DKIM for every service that sends as your domain, including transactional senders, then move DMARC from monitoring to a reject policy. This stops attackers from sending mail that looks like it came from you, and it is now a requirement for bulk senders at the major mailbox providers.
Passwords and SMS codes are not enough. Use passkeys or hardware security keys, block legacy authentication protocols, and apply conditional access by device and location. Account takeover is the attack that turns one mistake into access to years of data. For tenant-level hardening, see how to improve Google Workspace security.
Run a secure email gateway or an API-based filter that checks links, attachments, sender reputation, and lookalike domains. Add a banner to external mail so staff can see when a message did not come from inside the company.
Before you write a policy, find out what you are protecting. A historical scan across every mailbox shows where card numbers, Social Security numbers, health records, and API keys are stored, and who can reach them. This is the job of DSPM, and email is usually where it finds the most. New to the term? Start with what is DSPM, or run the PII scanner across mail and files.
Outbound email DLP checks the body and every attachment before a message leaves. When it finds regulated data headed to an outside address, it can redact the value, encrypt the message, hold it for approval, or block it. Most outbound leaks are mistakes, so the control should fix the email rather than punish the sender. For Microsoft tenants, pair it with the steps to encrypt email in Outlook and Office 365.
You are responsible for data that lands in your inbox, even when you never asked for it. Inbound email redaction removes card numbers, IDs, and PHI from incoming mail before staff open it, and can store the original in the Strac document vault that only authorized people can open. This is what PCI compliance for email and a HIPAA compliant email setup both require in practice. It is also the simplest form of data minimization.
A photo of a driver's license or a scanned bank statement is still sensitive data. Use detection with OCR that reads PDFs, images, screenshots, Word files, spreadsheets, CSVs, and ZIP archives. Text-only scanning misses the files that carry the most risk. The Strac catalog of sensitive data elements lists what the detectors cover.
Review OAuth grants to mailboxes on a schedule and remove the ones nobody uses. Treat AI assistants and agents with mailbox access like any other integration: if an agent can read an inbox over a connector, sensitive values should be removed before the agent receives them. See MCP DLP for agents, AI DLP for prompts and uploads, and how to detect shadow AI for the tools nobody approved.
Annual training fades in a week. A short notice at the point of the mistake ("this email contains a card number and is going to an outside address") teaches more than a slide deck, and it keeps people working instead of filing tickets.
Keep a record of every detection and action: what was found, in which mailbox, and what happened to it. Those logs are your evidence for HIPAA, PCI DSS, SOC 2, ISO 27001, and CCPA audits, and they show whether your policies are catching real data or just creating noise.
Strac connects to Google Workspace and Microsoft 365 through their APIs. A Workspace or Microsoft admin grants access, and Strac starts scanning inbound and outbound mail for the users you select. There are no MX record changes, no proxy, and no per-user setup, and the connection takes under 10 minutes. The setup is covered in the Gmail DLP guide and the Office 365 DLP guide.
When a message arrives with sensitive data, Strac replaces the value in the body or attachment with a redacted marker or a link to the Strac document vault. Only employees with the right permissions can open the link, and admins set when it expires. The email stays useful. The card number does not sit in the inbox.
Strac treats email as one of many places sensitive data lives, and applies the same detectors and policies to every one of them.
The same platform covers the places email data travels next: browser DLP and ChatGPT DLP for uploads to AI tools, endpoint DLP and Mac DLP for downloads and USB copies, and MCP DLP for AI agents reading mail through connectors. See DLP remediation for how each action works.
Email security used to mean keeping bad mail out. In 2026 it also means controlling the sensitive data that comes in, goes out, and sits in mailboxes for years, where attackers, apps, and AI agents can all reach it. Filters and MFA will fail eventually, so the data layer is the backstop: redact sensitive data in every inbox with email DLP, and a compromised account does not become a breach.
👉 Related reading:
No. A secure email gateway decides whether a message is safe to deliver, mostly by checking for phishing and malware. Email DLP looks at the data inside messages and attachments, in both directions and in stored mail, and redacts or blocks it.
Partly. Native DLP is tied to higher license tiers, focuses on outbound rules, and does not redact inbound mail or scan old messages well. Strac works on every paid Workspace plan and alongside Microsoft Purview DLP, redacts inbound and outbound, and scans history.
No. Strac redacts only the sensitive value and lets the rest of the email through, so work continues. Blocking is reserved for the cases that need it, and senders get a short explanation instead of a silent failure.
Not every one. Well-written phishing still gets through filters and fools careful people. That is why the data layer matters: if the mailbox holds no readable card numbers or IDs, a stolen login exposes far less.
DSPM (data security posture management) finds where sensitive data is stored and who can reach it. For email, that means scanning existing mailboxes for regulated data and ranking the risk. Read what is DSPM and see AI data governance for the full picture.
“Don’t just alert on problems, fix them.”
Scott Roberts, Chief Information Security Officer, UiPath
.webp)
.avif){kind=icon}
Customers include
.gif)
.webp)
