An email security gateway (also called a Secure Email Gateway, or SEG) is the control that sits in front of your mailboxes to filter inbound and outbound email — blocking phishing, business email compromise, spam, and malicious attachments before they reach users. Common examples include Microsoft Defender for Office 365, Proofpoint, Mimecast, and Cisco Secure Email.
Email Security Gateway Testing
Test your email security gateway continuously.
Email security gateway testing validates whether your Secure Email Gateway (SEG), anti-phishing tools, and malware scanners detect and block real email-based threats. Valitrix continuously tests your email security gateway with realistic phishing scenarios, malicious attachment simulations, and SEG bypass techniques — all mapped to MITRE ATT&CK.
What email security gateway testing covers
Secure Email Gateway (SEG) Testing
Validate email security gateway detection rates against phishing, BEC, spear-phishing, and malware delivery scenarios. Measure SEG bypass rates and identify filtering gaps before attackers do.
Malicious Attachment Delivery
Test whether your email controls detect malicious files — executables, macros, PDF exploits, archive-based droppers, and polyglot files — using a library of real-world payloads.
Phishing Simulation Scenarios
Run targeted phishing simulations with credential harvesting pages, lookalike domains, and HTML smuggling techniques to measure real-world detection and user resilience.
MITRE ATT&CK Initial Access Coverage
Email is the most common initial access vector. Valitrix maps every email security test to the MITRE ATT&CK Initial Access tactic — giving you a quantified view of your email attack surface.
See the product
This page covers email security gateway testing as a discipline. For the full Valitrix capability set — SEG bypass scoring, the phishing scenario library, attachment delivery testing, DMARC/SPF/DKIM validation, and user-risk metrics — see the Email Security Control Validation product page. Email is one layer of the wider security validation platform and of the commercial breach and attack simulation platform.
Email Security Gateway FAQEmail security gateway testing,
Email security gateway testing,
explained.
Email security gateway testing continuously validates whether your email security gateway, anti-phishing tools, and attachment scanners actually block real email-borne threats. It measures the gateway's true bypass rate against phishing, business email compromise, and malicious attachments instead of relying on the vendor's stated detection rate.
It can run in two modes. Passive testing validates the gateway's controls without delivering anything to users. Supervised simulation — only with prior management consent — measures user resilience as well. Valitrix never runs unannounced phishing campaigns without explicit authorisation.
Valitrix works with Microsoft 365 (Exchange Online), Google Workspace (Gmail), and on-premises Exchange, alongside most third-party SEG products. It also validates email authentication controls — SPF, DKIM, and DMARC.
Email is the most common initial access vector, so every email test is mapped to the MITRE ATT&CK Initial Access tactic and related techniques — giving you a quantified view of your email attack surface alongside the rest of your control coverage.
Test your email gateway
Ready to see if your defenses can stop real attacks?
Request a live demonstration of email security validation in your environment.