Why Phishing Defense Needs Software Engineers

If you’ve worked in security for any amount of time, you know that phishing is the attack vector that just won’t quit. It’s evolved from Nigerian prince emails to sophisticated credential harvesting operations powered by Phishing-as-a-Service (PhaaS) platforms like Tycoon 2FA. The attackers have leveled up—and honestly, most defenders are still playing catch-up.

Traditional approaches to phishing defense aren’t cutting it anymore. We need to think like software engineers.

The Problem with Traditional Phishing Defense

Most organizations approach phishing defense reactively. An email comes in, gets flagged (maybe), an analyst investigates, and if it’s malicious, they block the sender or domain. Rinse and repeat.

Detecting Phishing with Microsoft Email Headers

I also wrote a companion post on the Sublime Security blog: Getting started with Microsoft email headers for security. It covers these headers with hunts written for Sublime’s MQL. A copy of the original post is archived at the bottom of this page.

Original Post: Getting started with Microsoft email headers for security

Originally published August 27, 2026 on the Sublime Security blog. Archived here in case the original is removed.

Whether you’re a SOC analyst or a detection engineer, understanding Microsoft email infrastructure is advantageous for investigating and resolving email-based threats. If you’re working at a Microsoft shop, you may have already seen Microsoft’s recent Phishing actors exploit complex routing and misconfigurations to spoof domains blog. That post gives a great overview of how adversaries are taking advantage of misconfigurations that can happen when a SEG (secure email gateway) is placed in front of Microsoft, as we can see from this line: