We may need to start treating email retention as attack-surface retention. Companies keep years of email…
George B. — Senior Software Engineer
We may need to start treating email retention as attack-surface retention.
Companies keep years of email because storage is cheap and history is useful.
But an inbox isn’t just a collection of messages anymore. Given enough history, AI can reconstruct how an organization works: reporting lines, trusted relationships, suppliers, payment habits, approval processes, current projects and who has authority over what.
The longer the history, the better the model.
EvilTokens demonstrated the beginning of this: after compromising an account, AI was used to identify financial authority, map relationships and determine who an attacker should impersonate.
We spent years asking how long companies should retain email for compliance.
There may now be another question worth asking:
How much organizational memory should a compromised identity be able to access at once?
3 reactions · 0 comments