Your Email Security Might Have a Door Propped Open

Key takeaways

• Microsoft detected about 7.3 billion email phishing threats in Q3 2026, with a 41% jump from August to September.
• Many malicious emails reached inboxes because businesses had set up exceptions that let certain mail skip security checks.
• Attackers impersonate everyday services like DocuSign and Adobe, and they're using Microsoft Teams calls too.
• Five checks you can do this month, starting with a review of your email exceptions, close the most common gaps.

It's 4:45 on a Friday

Your office manager gets a DocuSign request from a vendor you've worked with for years. The logo is right, the tone is right, and the contract looks routine. She clicks, signs in, and heads home for the weekend.

That wasn't DocuSign. And here's the part that should bother you: your email security probably should have caught it.

In its latest email threat report, Microsoft found that many malicious messages were delivered because organization- or user-configured exceptions overrode security protections. Somebody, at some point, propped the door open. Maybe it was to keep a vendor's invoices out of spam. Maybe it was a "temporary" fix from three years ago. Either way, nobody closed it.

Having security tools isn't the same as having security tools that work.

The numbers behind the latest phishing trends

Microsoft detected about 7.3 billion email-based phishing threats from July through September 2026. September alone hit nearly 3 billion, up 41% from August.

Volume actually declined through most of the quarter before that September spike. The volume isn't the scary part. The quality is. DocuSign was the most frequently spoofed brand in September, Adobe impersonation rose toward the end of the quarter, and Microsoft counted about 141,000 malicious Microsoft Teams call attempts in Q3. Teams is where people tend to let their guard down.

The goal hasn't changed: get someone to click a link, hand over a password, open an attachment, or approve a payment that lands in the wrong account. That last one, known as business email compromise, is where small businesses lose real money.

What phishing looks like in your office

Attackers don't send random junk anymore. They send the email your team is already expecting.

Small business email security: five things to do this month

1. Find out what exceptions exist. Ask whoever manages your email for a list of allow rules and bypasses. If nobody knows, that's your answer.
2. Turn on multi-factor authentication everywhere. Phishing-resistant options like passkeys or security keys beat text-message codes.
3. Verify money changes by phone. Any request to change payment details gets a call to a number you already have, never the one in the email.
4. Review who has admin access. Every extra admin account is one more key an attacker can steal. Former employees and old vendors are the usual suspects.
5. Teach your team what normal looks like. Surprise DocuSign requests, unexpected invoices, and Teams calls from "IT support" all deserve a second look.

Related reading: The Complete Small-Business Cybersecurity Checklist for 2026 · Cybersecurity services · Managed IT

Frequently asked questions

What is an email security exception?

An email security exception is a rule that lets certain messages skip some or all of your filtering, usually to stop legitimate mail from landing in spam. Attackers benefit when those rules are too broad or never get reviewed.

How many phishing emails did Microsoft detect in Q3 2026?

Microsoft reported about 7.3 billion email-based phishing threats from July through September 2026, including nearly 3 billion in September alone.

Why do attackers impersonate DocuSign and Adobe?

Because businesses use them every day. A signing request or shared file feels routine, so people click without thinking twice.

Is multi-factor authentication enough to stop phishing?

It helps a lot, but not every method is equal. Phishing-resistant options like passkeys and security keys hold up far better than text-message codes, and multi-factor authentication works best alongside good email settings and trained staff.

How Hawkins Consulting can help

We'll help you check the doors. Start with the free two-minute Security Checkup: twelve questions that show which of the five cybersecurity essentials you have in place and what to fix first.

Then book a free consultation and we'll walk through your Microsoft 365 email settings and exceptions, multi-factor authentication, admin accounts, and Teams external access with you, in plain English: what's working, what's propped open, and what to fix first.

You don't need an enterprise IT department to take this seriously. You just need someone to check the doors before somebody else does.

Source

Microsoft Threat Intelligence and Microsoft Defender Security Research Team, Email threat landscape: Q3 2026 trends and insights, November 5, 2026.