How Darktrace email security catches the 17% of threats that SEGs miss

New research published by Darktrace shows that nearly one in six of the riskiest inbound emails still evade native security layers after Microsoft filtering, with an average SEG miss rate of about 17%. The metric comes from a volume-weighted analysis of real-world deployments where Darktrace operated alongside a SEG versus configurations without one, counting a missed email as any threat the SEG failed to catch at initial filtering but that exposed users later.

Darktrace / EMAIL addresses these gaps with Self-Learning AI that learns each organisation’s normal communications and correlates signals across email, identity and SaaS to expose context-driven attacks such as social engineering, impersonation and multi-stage campaigns. The update also introduces cross-domain detection and label-free behavioural DLP, and integrates with Microsoft Defender and Security Copilot to streamline investigation and response.

Darktrace notes that its approach can catch threats that SEGs miss, including sophisticated email bombing and cloud platform abuse, while maintaining operational continuity. The Live Launch Event to showcase these innovations is planned for 9 December 2025.