Gaps in Microsoft 365 Email Security

This document is a technical report that identifies seven significant gaps in the email security capabilities of Microsoft 365, particularly in relation to native protections offered by Exchange Online Protection and Microsoft Defender for Office 365. It outlines the limitations of Microsoft’s security features, including inadequate threat detection efficacy, insufficient data backup solutions, and limitations in zero-day attachment and URL sandboxing. The report details how Microsoft’s average miss rate for advanced email attacks is notably high, with specific figures indicating a 47% miss rate and an 88% miss rate for conversation hijacking attacks. Additionally, it discusses the challenges organizations face in recovering data and the lack of coordinated investigation and recovery workflows in the event of email-borne threats. The report concludes by presenting Barracuda's solutions as a means to enhance email security and address these identified gaps.