Why "phishing protection" misses the point
Every vendor lists phishing protection, but phishing is not one thing. Spoofing, impersonation and phishing each need a different defense, and lumping them together leaves your clients exposed.
Three attacks, not one
- Spoofing is technical forgery. Attackers falsify a display name, sending address or domain. SPF, DKIM and DMARC expose the broken authentication chain, and secure email gateways stop it well.
- Impersonation passes every check. An attacker registers a lookalike support domain, sets up SPF and DKIM correctly and clears every standard filter. Stopping it takes organizational context: who talks to whom, from where and how consistently.
- Phishing is the objective. It is the goal behind both: getting someone to click, download, pay or hand over credentials.
AI closed the gap
Generative AI can scrape public profiles, match someone's vocabulary and write a convincing message in minutes. The FBI's 2025 Internet Crime Report documented 22,364 AI-related complaints with over $893 million in losses, and says that figure is almost certainly low. Phishing complaints declined slightly in 2025 while phishing losses tripled, so attacks are getting more targeted, not just more frequent.
Match the defense to the attack
Gateways handle authentication, DMARC and perimeter filtering, but do not know your client's vendors, org chart or how their CFO writes. API integrations with Microsoft 365 catch those behavioral deviations, but on their own they have no perimeter, so threats land first and get cleaned up after.
Many MSPs stacked an API tool on a gateway, which means multiple licenses, disconnected policies and finger-pointing when something slips through.
One system
Shield builds the gateway and API into a unified system that shares context in real time. The gateway stops threats at the perimeter, the API connects to the directory and communication history, and only mail that belongs reaches the inbox.