of attacks carry 98% of the modeled financial risk.
The Phishing Genome · Q2 2026 · 32,052 attacks, Apr–Jun 2026
STRONGESTLAYER THREAT LAB
What our Threat Lab is seeing.
Research, free tools, the blog and customer stories, all in one place and all ungated. Pick where to start.
FREE TOOL · OPEN TO THE COMMUNITY
Corporate Email Posture Check
Map your public data exposure against your stack’s actual capabilities. See exactly where you’re missing BEC and phishing variants right now.
- 24
- Public data types attackers harvest before they write
- 44
- Email attack subtypes mapped to your stack
- 22
- Evasion techniques attackers use to bypass
- 5
- Detection technologies graded across vendors
The Phishing Genome
3.6%
of attacks carry 98% of the modeled financial risk. 32,052 attacks, Apr to Jun 2026.
Read the report → CUSTOMER STORY · LAW FIRMA major law firm found the attacks Microsoft E5 and its gateway were missing.
- >99%
- Novel attacks caught
- 80%
- Less investigation time
The library
Everything the Threat Lab publishes. Filter by type.
- Research
The Phishing Genome
Where the financial risk concentrates, and how much of it passes authentication.
- Research
1,400 Ways Attackers Beat Your Email Security
How attackers stack evasion techniques, and why a filter that checks one at a time misses the combination.
- Research
Email Attack Taxonomy
Every email attack subtype, mapped by category, with a walkable kill-chain simulation for each one.
- Research
Email Evasion Taxonomy
Evasion techniques organized by the detection capability each one defeats. The companion to the attack taxonomy.
- Research
Corporate PDA Taxonomy
The public company data attackers collect before a targeted email, and the attacks each type makes possible.
- Research
The Email Is Not the Threat
A trusted vendor emails your accounts-payable team to update her banking details. Every authentication check passes. Every word is plausible. The same message is either routine…
- Research
DMARC for CISOs: What It Actually Protects (And What It Doesn’t)
DMARC protects outbound domain reputation against exact spoofing but covers only about 1% of the email threat surface. It doesn’t stop lookalike domains, BEC, compromised…
- Research
The End of the Biggening: Why Mythos Demands a New Detection Architecture
Why Mythos Is Not a Warning. It Is a Structural Indictment of Training-Based Detection in an Era of Compounding AI Capability.
- Research
The Architecture of Evasion
Exploring how QR code phishing bypasses enterprise email defenses.
- Research
The Zero Trust Paradox
This paper highlights the conflict between email security and Zero Trust principles.
- Research
What Your Email Security Can't See
Study of 2,042 attacks bypassing Microsoft E3/E5 and leading SEGs.
- Research
Three Axes of Email Security
This whitepaper explains why AI breaks email security and introduces a framework comparing rules, ML, and LLM-native platforms across completeness, accuracy, and response speed…
- Research
The DocuSign Detection Gap: Why Signature-Based Email Security Fails Against Modern Impersonation Attacks
DocuSign impersonation now dominates advanced email attacks, bypassing Microsoft E3/E5 and leading gateways. Analysis of 2,500+ Q4 2025 attacks shows DocuSign-themed threats…
- Research
The Training Paradox: The Solution - Real-Time Verification and In-the-Moment Learning
Security awareness training fights human nature instead of working with it. Part 2 introduces Real-Time Verification: an AI “analyst in the inbox” that protects employees at the…
- Research
StrongestLayer Solution Brief
A two-page overview of how attackers use AI to scale, disguise and personalize email attacks, why signature, reputation and behavioral tools cannot keep up, and how…
- Research
The Collapse of Traditional Threat Detection in the AI Era
This whitepaper reveals how AI phishing bypasses legacy tools, explains automated attack pipelines, and introduces TRACE, an intent-based engine delivering full detection where…
- Research
The Email Security Architectural Crisis: How AI Attacks Are Exposing Enterprise Risk Gaps
This whitepaper explains why legacy email security fails against AI phishing and shows how AI-native architectures eliminate false positives, detect novel threats, and restore…
- Research
The Rise of AI-Generated Email Security Threats
The report analyzes AI-driven email threats, showing phishing clickthroughs surging, Microsoft 365 filters failing, and legacy defenses lagging, urging organizations to adapt…
- Research
The Training Paradox: How Security Awareness Became Your Biggest Security Risk
The Training Paradox shows why security awareness fails in the AI era and introduces human risk management with real-time learning to reduce risk, fatigue, wasted productivity…
- Free tool
Email Posture Check
See where you’re exposed. Built on the same threat research that powers our detection.
- Free tool
Free Frameworks
Analyst-built references.
- Free tool
Hackers Against Humans
A free party game: your team builds the phishing emails. 104 cards, each with a real security tip.
- Customer story
What Microsoft E5 and a leading gateway missed at a major law firm
A 10-day assessment running alongside the firm’s existing stack found AI-powered social engineering reaching user mailboxes undetected.
- Customer story
A law firm’s security team, in their words
What took our team 15 minutes to investigate now takes seconds.
- Customer story
Major Law Firm Case Study: 347 Threats Bypassed Microsoft E5 + Leading SEG in 10 Days
A major law firm learned that despite Microsoft E5 and a secure email gateway, AI-driven social engineering still bypassed defenses; in ten days, StrongestLayer found 347 missed…
- Blog
We Analyzed 2,500 DocuSign Attacks. Here’s Why They Bypassed Your Gateway
Why traditional rules fail against AI-native threats and how reasoning fixes it.
- Blog
Enterprise Email Security Benchmarks for 2026: What Matters Now?
The benchmarks that matter for enterprise email security in 2026.
- Blog
The 5 Best Email Security Tools for Mid-Market Teams in 2026
How API-based platforms compare with secure email gateways for mid-market teams.
- Blog
Leveraging TRACE for Real-Time Email Threat Prevention
AI-driven pre-campaign threat detection and real-time phishing defense to keep BEC, spear-phish, and malware out.
- Blog
The Fiduciary Firewall: Protecting Law Firms from Insider Threats and AI Phishing
Why Human Risk Scoring is mandatory for law firms facing AI-driven threats.
Citable findings
Each finding has its own permalink, source and date. Copy a citation for your board deck, or link straight to it.
- 3.6%
- 86%
of attacks that reached the inbox passed SPF, DKIM and DMARC.
The Phishing Genome · Q2 2026 · 32,052 attacks, Apr–Jun 2026
- 4.1
evasion techniques stacked in the average attack.
1,400 Ways Attackers Beat Your Email Security · Q1 2026 · ~5,000 attacks, Dec 2025–Feb 2026
- 44
email attack subtypes mapped to your stack in the Posture Check.
Corporate Email Posture Check · StrongestLayer Threat Research
Free AI gap check
Do you have an AI gap? Find out what’s getting through.
See which generations of defense you’re running and what it takes to close the gap. Two minutes. No signup. Nothing changes in your environment.