The Kill Chain Methodology In Use Today

Three evasion layers. Not one MITRE tactic.

Every detection in our dataset is, by definition, an email that reached StrongestLayer. It already bypassed whatever SEG was upstream. Survivorship bias is the feature, not the bug: this is a map of what is getting through, not what exists in the wild. The organizing principle is the three-layer evasion architecture. Each layer defeats a different detection capability. The combination is what creates the gap.

Layer 1
Trusted Delivery
The email arrives through legitimate infrastructure. SendGrid, Google Calendar, SharePoint sharing, Google redirect endpoints. Authentication passes. Reputation scores are clean.
Defeats: Reputation filtering. Sender intelligence. Allow-list logic.
Layer 2
Anti-Scanner
The payload is protected by CAPTCHA gates, encoded inside QR codes, image-based content, HTML smuggling, or multi-hop redirects that exceed scanner recursion depth.
Defeats: Sandbox analysis. URL detonation. Text-based content scanning.
Layer 3
Channel Pivot
The exploitation leaves email entirely. Phone call, SMS, personal mobile device, Teams, voice call, WhatsApp. The malicious action happens where email security has no visibility.
Defeats: Post-delivery remediation. Retroactive removal. Forensic reconstruction.

The Compounding Blind Spot

Each layer is independently effective. The combination multiplies. 35.9% of detections fall into structural blind spots, 20% defeat sandbox through anti-scanner logic, and 44% exist in a detection window where blocking would cost more in false positives than the miss costs in risk. The simulations below walk each layer stage by stage for 12 representative attacks.

Free AI gap check

Do you have an AI gap? Find out what’s getting through.

See which generations of defense you’re running and what it takes to close the gap. Two minutes. No signup. Nothing changes in your environment.

Book a demo Find my AI gap →