UAE banks do not fail email security because their gateway misses phishing. They fail because they treat the gateway as the whole control and skip what actually stops credential theft: DMARC enforcement at p=reject, and phishing simulation results fed back into training instead of a compliance folder.
- A gateway blocks bulk phishing well, targeted phishing poorly. No regulator treats it as sufficient alone.
- Most UAE organisations still run DMARC at p=none years after adopting it. Monitoring without enforcement stops nothing.
- Business email compromise rarely carries malware; it relies on lookalike domains and process gaps.
- Assessors ask for DMARC reports, gateway configuration, and simulation click rates, not a product.
Why the gateway alone does not hold
A secure email gateway filters high-volume, low-sophistication phishing using sender reputation, known bad infrastructure, and attachment signatures. That covers most inbound phishing, including botnets such as PowMix that spread via phishing lures rather than a technical exploit.
It is weak against anything built for one target. A spear-phishing email from a freshly registered domain, with no attachment or link at send time and wording lifted from a real internal thread, has no signature to match and nothing to penalise. That is the gap in most UAE bank assessments: the vendor's near-total block-rate claim holds for the traffic the gateway was built to stop, not the traffic causing the incidents.
What a layered stack looks like
No single product closes this gap. A working stack combines a perimeter gateway such as Microsoft Defender for Office 365 or a secure email gateway like Mimecast, click-time URL re-evaluation, browser isolation for links the gateway cannot clear, DMARC/SPF/DKIM enforced (not just published), endpoint detection as the backstop for the click that gets through anyway, and simulated phishing tied to a reporting workflow. Removing one layer does not remove the risk; it just moves the failure point.
DMARC enforcement is the gap most banks never close
Publishing a DMARC record at p=none is trivial, and most UAE organisations did it years ago for a compliance questionnaire. It does nothing alone: p=none asks receiving servers to report failures, not reject or quarantine them, so a spoofed payment instruction still gets delivered.
Moving to p=quarantine and then p=reject is where the protection sits, and where most projects stall. The blocker is rarely the DNS record; it is a missing inventory of every service sending mail on the organisation's behalf, from the HR platform to a regional office running its own relay. Each source needs SPF and DKIM alignment first, or legitimate mail starts bouncing once the policy tightens. The fix is a phased rollout: gather aggregate reports for several weeks, fix authentication for every sender found, move to quarantine, then reject. DMARC enforcement platforms such as DMARCS manage that transition without breaking mail flow.
Business email compromise is a different problem than bulk phishing
Bulk phishing is a volume problem, blocked by reputation and pattern matching. Business email compromise is a targeting problem: it typically carries no malware, just a spoofed or lookalike domain, correct names pulled from a public profile, and a request timed around a supplier invoice or a payroll run. A gateway built to catch payloads has almost nothing to inspect. What stops it is DMARC enforcement against exact-domain spoofing, lookalike domain monitoring, and a hard rule verifying payment changes through a second channel, a control most banks skip because it slows the finance team down.
What NESA and CBUAE expect
Neither NESA controls nor the CBUAE cybersecurity requirements mandate a named product. Assessors expect evidence: a documented email architecture, DMARC reporting history, phishing simulation results, and a link between an email incident and the incident response process. A modest period of DMARC reports and measured training improvement beats an expensive gateway nobody has reconfigured since deployment.
Training that changes click rates
Annual awareness training delivered as a slide deck changes almost nothing measurable. What moves click rates is simulated phishing run continuously, at increasing difficulty, with results reported to individuals and managers rather than one organisation-wide number. Programmes that improve reward reporting a suspicious email over punishing a click, because a workforce afraid of blame stops reporting. Simulated phishing platforms like KnowBe4 are built around that loop: simulate, measure, retrain, and track the trend over quarters.
Closing the gap: what to fix first
If only one thing changes after reading this, move DMARC from p=none to enforcement. It closes exact-domain spoofing across every mailbox at once, not just the ones a gateway inspects. After that, in order: inventory every sending source and align SPF and DKIM; layer gateway filtering, click-time checks, and endpoint detection so no single vendor's claim stands alone; add a second-channel check on payment changes; run phishing simulation continuously, keeping the reports as evidence.
None of this needs a bigger budget than most UAE banks already allocate to email security, just spending on enforcement and process, not another layer on a gateway that was never going to stop them.
