Most marketers think of email security as an IT problem. It isn’t, not anymore. In a recent Cyberimpact webinar, Nihal Mandanna CP from Cyberimpact sat down with Ben Fox, founder of ZeroArc (and FP Digital), to talk about why marketing teams now own a growing share of their organization’s email risk, and what to actually do about it.
Here’s a breakdown of the webinar’s key takeaways and a practical framework you can start using this week.
Watch the full webinar on YouTube
Why Email Security Has Become a Marketing Problem
During the webinar, Ben shared two real stories to illustrate just how much brand damage can happen even when a company did nothing wrong.
A few years ago, thousands of not-for-profits and charities had to warn their donors that personal data might have been exposed. None of them had actually been breached but their shared fundraising software vendor had been, and the vendor ended up paying a six-figure ransom and issuing tens of millions of dollars in restitution. But it was the charities, not the vendor, who had to send the “your data may be at risk” emails, and it was their email deliverability and donor trust that took the hit.
The twist: nearly all of those organizations had SPF, DKIM, and DMARC turned on. Good starting points, but they only verify that a sender is who they claim to be. They do nothing to stop a trusted third-party vendor from being compromised, or to catch a lookalike domain built to impersonate your brand.
The second story was about a well-known crypto hardware wallet company with what looked like a flawless security setup: two-factor authentication everywhere, a dedicated security operations team, the works. A phishing email still got through every check, someone clicked, and client wallet credentials were exposed. Not necessarily the company’s fault, but its brand, one built entirely on trust and security, is still being talked about because of it.
The lesson here is that strong technical setup is necessary, but it isn’t sufficient.
Impersonation, vendor risk, and human error live in the space that basic email authentication doesn’t cover, and that space belongs to marketing just as much as it belongs to IT.
Speed is the New Threat
Impersonation attempts aren’t new at all. What’s changed is how fast they move. Ben pointed out that not long ago, a security alert gave your team roughly eight minutes to catch and contain a problem before real damage was done. Today, that window has shrunk to about ten seconds. An alert reaching a human is often already too late to stop a breach in progress.
AI-generated phishing at scale is accelerating this. Attacks that once required real effort to craft (convincing language, a believable lookalike domain, a plausible pretext) can now be generated instantly and at volume, and that trend is only going to intensify, so brands also need smarter and faster response strategies.
The Six Ways Attackers Can Wear Your Brand
Ben listed six categories for the ways attackers impersonate an organization, sometimes called “doors”:
- Vendor blast radius: Every platform you authorize to send email on your behalf (your ESP, your CRM, your event platform) can send mail that passes SPF, DKIM, and DMARC simply because you gave it permission. If any of those vendors get breached, so does your brand’s reputation.
- Lookalike domains: Domains built to closely resemble yours, often used to intercept customers or trick employees.
- Business email compromise (BEC): Impersonating executives or other senior staff to convince someone junior to make a payment, buy a gift card, or hand over credentials. Google and Facebook famously lost between $110 and $120 million to a BEC scheme using lookalike domains and invoices that appeared to come from real vendors.
- Form abuse and ad fraud: List poisoning (bots signing up with fake or compromised emails) can tank your deliverability and waste ad and marketing budget. People believe removing CAPTCHA will reduce sign-up friction and increase your sign ups, however it is also one of the most common ways to let this attack happen.
- Landing page and supply chain attacks (including shadow AI): Compromised tracking pixels, tags, or plugins can redirect users or leak data, often introduced by well-meaning marketers just trying to “get the pixel installed.” This category also includes shadow AI: employees using unsanctioned AI tools with company or customer data outside anyone’s visibility.
- SaaS account takeover: Compromised logins, shared passwords, and missing multi-factor authentication. The most human of the six, and, according to Ben, one of the easiest to defend against.
The Three Rings of Defence for Email Security
Rather than treating these as six separate problems, Ben’s team at ZeroArc organizes defence into three concentric rings, with the marketing or brand team sitting in the middle sending email through all of them.
Ring 1: Brand and Inbox
- Enforce DMARC at “reject,” not just “none.” A DMARC policy set to “none” only reports bad activity, it doesn’t stop it. Think of it as a camera on your front door that never locks it.
- Filter your inbox with AI-powered phishing and impersonation detection. Human review alone isn’t fast enough anymore.
- Watch your domains continuously so you catch lookalikes before your customers do.
Ring 2: Account and Human
- Turn on identity monitoring for your team, not just for individual employees personally. If someone on your team has their identity stolen, your brand is at risk too.
- Lock down access with multi-factor authentication everywhere and role-based permissions, reviewed regularly. If everyone on your WordPress site has admin access, that’s a problem to fix today.
- Invest in ongoing phishing awareness training. It doesn’t need to be expensive or time-consuming, even 15 to 20 minutes a month per person makes a meaningful difference.
Ring 3: Apps and AI
- Standardize on single sign-on where possible, so access can be centrally managed and revoked.
- Govern shadow AI with clear policies about which tools are approved and observability into what data moves in and out of AI tools.
- Clean up old API keys, OAuth connections, and admin access left over from tools or team members you no longer use. When you switch platforms, don’t just let the old subscription expire, revoke the SPF authorization and kill unused API keys too.
What a Real Attack Looks Like
During the webinar, Ben ran a live demo of Cloudflare’s brand protection and email monitoring tools, which surfaced dozens of lookalike domains registered to mimic well-known brands, and even a much smaller company, in the past month alone.
He then walked through a real quarantined email that had, on paper, passed SPF, DKIM, and DMARC entirely. What gave it away wasn’t the authentication, it was the details: the registered domain belonged to an unrelated medical booking company whose infrastructure had apparently been compromised, and the sender’s name and company didn’t match the industry the email claimed to be from. It’s a useful reminder that passing authentication checks confirms a sender is who they say they are; it doesn’t confirm they’re legitimate.
Consent and Compliance: CASL and Law 25
Compliance is often seen as a legal checkbox rather than a trust-building tool, but the two are more connected than they seem.
As Nihal, Director of Growth at Cyberimpact, explained, consent and authentication are two different halves of inbox trust: CASL and Quebec’s Law 25 govern your legal right to send (through express or implied consent), while SPF, DKIM, and DMARC are the technical proof of your identity. Neither one replaces the other. You need both to build real trust with inbox providers and with your audience.
A few practical points from the discussion:
- Implied consent isn’t permanent, but it can remain valid through renewed transactions, like a repeat donation.
- Whenever possible, move contacts from implied to express consent as quickly as you can. It’s the strongest form of consent you can have.
- Where you store your data matters. Cyberimpact is built with Canadian data residency and sovereignty in mind, which increasingly factors into both deliverability and overall brand trust.
Deliverability Best Practices
A few habits separate healthy lists from ones that quietly erode trust with inbox providers over time:
- Watch engagement, not just spam filters: Inbox providers increasingly weigh whether people open, click, and engage with your emails, not just whether your subject line avoids spammy words.
- Read your unsubscribe reasons: They sometimes reveal issues you wouldn’t otherwise catch, including situations where contacts are receiving spam from a compromised domain without realizing it.
- Keep your brand identity consistent: across every email so your audience can recognize and trust you at a glance.
How to Improve Your Email Security Right Away
- Set your DMARC policy to reject, not “none,” so bad actors can’t send email that passes as yours.
- List every tool and vendor authorized to send on your behalf, and review that list every quarter.
- Turn on multi-factor authentication everywhere. It’s free, and if a vendor doesn’t offer it, that’s a reason to reconsider them.
- Create a shadow AI policy that names which tools are approved, so your team isn’t finding workarounds on their own.
- Push contacts toward express consent when they join your list, rather than relying on implied consent.
- Review your off-boarding process for any tool or team member you no longer use. Don’t forget to revoke API keys, kill old SPF authorizations, and remove unused admin access.
How Cyberimpact Keeps Your Email Safe?
Cyberimpact is a Canadian email marketing platform built for organizations looking for strong deliverability and easy compliance with Canadian data privacy laws like CASL, PIPEDA and Quebec’s Law 25. Beyond consent management tools, Cyberimpact has role-based access controls, multi-factor authentication, SSO login, and formal incident response processes to protect both your data and your audience’s, with full details available on its Trust Center.
Security isn’t a “set it and forget it” feature, on either side of the sending relationship. Protecting your brand in 2026 and beyond means combining the right technical foundation with an ongoing, shared responsibility between marketing, IT, and your vendors.