Key takeaways
- Critical infrastructure organizations are not opportunistic targets. They are selected deliberately as email is almost synonymous with business continuity. The campaigns against them are long-term, multi-actor operations that often begin with email.
- Attackers test their payloads against enterprise security stacks before delivery. A malicious file that passes your scanner is not evidence that the file is clean; it’s possible that it was built to pass your scanner.
- Detection-first security has a structural vulnerability against a prepared adversary: it cannot act on what it has not encountered before.
- Layered email defense is the structural response. Each layer catches what the others are not built to see. The combined effect is simple: it raises the cost of pre-deployment optimization for the attacker.
It is not an email attack, it’s a campaign
No security professional decides to treat threats as isolated events. It happens incrementally. Detection rates hold steady, incidents get resolved on schedule, and audits pass without significant findings. Each data point is individually reasonable, and together they build a picture that is entirely accurate and dangerously incomplete.
That accumulation of confidence is itself a vulnerability. And for critical infrastructure organizations, it is one that attackers exploit deliberately, starting with the inbox, which remains to this day one of the primary vectors for email security risks.
When a state-sponsored group targets an energy grid, a hospital, or a defense contractor, that can be a multi-year campaign. These often involve hundreds of iterations, probing attempts, and decoy attacks designed to map out defenses before the real payload arrives. Their goal is sustained disruption, repeated exposure, and maximum reputational damage over time. The ransom calculation happened before they sent the first email, and what is worse is that the attackers already know their target cannot afford downtime.
Threat actors have different motivations and different attack profiles, but one thing in common: targeting. Critical infrastructure organizations are not stumbled upon, they are selected, and the campaigns against them are long-term processes that almost always begin with email.
The first move is a weaponized attachment, a malicious link, or a carefully researched and customized credential phishing attempt, delivered to an engineer, an operator, or an executive. And the reason email remains the preferred entry point is not technical sophistication, but mathematical simplicity. Organizations cannot close or restrict it without disrupting operations.
One employee, one bad day, one opened file. That is the entire win condition. A campaign that reaches thousands of inboxes simultaneously needs only one moment of weakness to succeed, and the defender has to prevent every one of them.
The campaign model is already visible in U.S. critical infrastructure. A joint advisory from CISA, NSA, and FBI confirmed that Volt Typhoon actors lived inside some IT networks for at least five years to pre-position for potential disruptive or destructive attacks against operational technology.
None of these actors will recalibrate because a target patched faster or hired more analysts. The attacks are a tactical play, most often part of a larger strategy.
The posture that follows from this is not optional. Critical infrastructure organizations should operate with the standing assumption that a breach will happen and build accordingly: layered defenses at every entry point, and a response capability close enough to the surface that containment begins before the damage compounds.
Attackers test their payloads before they deploy
The practice is widespread and documented. Across state-sponsored groups, ransomware operators, and sophisticated criminal organizations, payloads go through a staging process before they are ever sent. Adversaries build replicas of enterprise security stacks, iterate until the file achieves a clean detection score, and only then deliver it.
In 2025, a coordinated international operation took down AVCheck, one of the world's largest counter-antivirus services, which allowed malware developers to test whether their files would be detected before deployment. The service existed because the demand for pre-delivery evasion testing was large enough to sustain a commercial operation built around it.
Detection-first security has a structural vulnerability against a prepared adversary. It is built to recognize threats it has encountered before, or that closely resemble something already in its history. A payload specifically engineered to match neither category passes through by giving the detection layer nothing to act on.
That optimization does not happen once. Across years of iterations and hundreds of probing attempts, every quarantine and every block is feedback the attacker uses to refine the next attempt. The campaign learns from your defenses in a way that your defenses cannot automatically reciprocate. This is a logical consequence of operating detection-first against an attacker who has specifically prepared for your detection.
What that means for how you build your email security defense lines
The attacker who attempts building a replica of your security stack to pre-test their payload cannot easily replicate the exact combination and sequencing of multiple independent layers. That is the strategic logic behind layered email defense: it is more than extra coverage; it is a structural response that raises the cost of the pre-deployment optimization process the attacker depends on.
The logic holds because each layer operates on a different principle and catches what the others are not built to see.
- Multiscanning email security increases coverage by running attachments across multiple independent engines simultaneously, making payload optimization against any single engine insufficient.
- Content Disarm and Reconstruction (CDR) removes active content from every file regardless of whether it has been seen before, which means a payload engineered to evade signature detection is still stripped of its active components.
- Sandboxing exposes behavior at execution, catching the payloads specifically engineered to defer malicious behavior until after delivery.
- URL analysis at time-of-click closes the window between delivery and weaponization.
- Data Loss Prevention (DLP) on outbound and internal email closes the visibility gap that inbound-only controls leave open entirely.
No individual component catches everything. What the combination does is make pre-testing against your stack structurally harder with every layer added.
A caught threat might only tell you the attacker is still calibrating. Treat it as a signal rather than a sign your defenses are holding. Operating under this assumption is simply a rational response to being selected by multiple actor types running long-term campaigns.
Layered coverage at the email boundary, responsive measures that contain damage before it cascades, and a continuous improvement posture that treats every incident as intelligence about the campaign rather than a closed ticket: that is what meaningful protection looks like for critical infrastructure organizations.
Now imagine this targeting at an industrial scale. Imagine the attacker who used to spend weeks optimizing a payload for one specific target can now do it for thousands simultaneously, in hours. Microsoft Digital Defense Report 2025 cited an independent research that found that AI-driven phishing achieved a 54% click-through rate compared to 12% for traditional campaigns, making it 4.5 times more effective. This is what AI has already made possible, and it is the subject of the next article in this series.
This blog is part 1 of “Made to Evade” series.
Part 2 and 3 are coming soon.
