Email Security: What Should a Philippine Pilot Prove?

What should a Philippine email-security pilot prove?

A Philippine email-security pilot should prove that your team can detect impersonation, investigate suspicious messages, protect legitimate mail, and act on confirmed threats before you approve a contract. Test your actual mail routes and response ownership, using authorized simulations. Require evidence for missed threats, blocked business messages, exceptions, and rollback.

Key takeaways

• An email-security pilot should test both forged senders and suspicious requests from an authenticated sender.
• Email-security approval should depend on message-level evidence rather than a vendor's aggregate detection percentage.
• Legitimate mail delivery and controlled rollback should carry the same review weight as threat detection.
• Philippine privacy review should cover the message content, permissions, and evidence shared with a security provider.

The FBI's 2025 Internet Crime Report records 24,768 business email compromise complaints and $3,046,598,558 in reported losses for that category in 2025. The same report records 191,561 phishing/spoofing complaints in 2025. These are three observations from the FBI's complaint dataset, not Philippine incidence rates, unique victim counts, or estimates of your expected loss. Use the figures to justify testing distinct attack paths, not to promise a financial return.

Before inviting vendors, document the mail paths you want protected. Include employee mailboxes, shared mailboxes, approved external senders, forwarded messages, and internal messages where applicable. Ask each provider to mark what its proposed configuration inspects, what it cannot inspect, and which actions require another tool or your own administrator.

Use Infocentric's email-security service to frame the service category, then write your own acceptance conditions. Specify the pilot's authorized accounts, safe message content, permitted actions, evidence owner, and business approver. Do not let a demonstration mailbox become the evidence for an entire organization. A CISO in Ortigas should be able to trace each purchasing requirement to a recorded test result, an unresolved limitation, or an explicitly accepted risk.

Which messages should the pilot test separately?

The email-security pilot should test sender authentication, suspicious message intent, and legitimate delivery separately, because each test asks a different purchasing question. Microsoft's email-authentication documentation describes Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting, and Conformance (DMARC) as complementary checks against forged senders. Its DMARC guidance explains that a message passes when an aligned SPF or DKIM check succeeds. Domain authentication is not evidence that a requested business action is authorized.

The following original comparison turns those documented boundaries into buyer tests; it is a proposed acceptance aid, not a benchmark or a report of tests already performed.

Test message	Purchasing question	Evidence to request
Forged message using your domain	Does the configured control enforce the intended authentication policy?	Headers, authentication verdict, policy, and final disposition.
Lookalike sender domain	Does the proposed protection recognize the chosen impersonation scenario?	Exact sender, detection rationale, and analyst decision.
Suspicious request from an authorized test sender	Can the team investigate intent when domain checks pass?	Message context, alert or report, and documented verification.
Benign link or attachment simulation	Does the purchased configuration perform the promised inspection?	Inspection result, message action, and licensed feature scope.
Legitimate forwarded or service-generated mail	Does protection preserve the approved business route?	Delivery result, authentication changes, and any exception.

Run each scenario only with permission and synthetic content. Do not compromise a supplier mailbox or introduce live malware. For a trusted-sender scenario, use an account you control and explain that the scenario represents suspicious intent, not an actual account takeover.

Microsoft documents that forwarding and intermediary message changes can disrupt authentication. Include those routes before approving enforcement, and retain a legitimate-mail sample beside the threat sample. Ask the analyst to explain why each message was blocked, delivered, or escalated. Record a miss even when another control later catches the message. Where mailbox access is part of the response, define responsibilities alongside Infocentric's access-management services, rather than assuming the email product owns identity decisions.

What evidence should you require before signing?

Require a repeatable test record, a named response owner, privacy-reviewed data handling, and a demonstrated reversal plan before signing an email-security contract. Agree on those purchasing conditions before testing so the vendor and your reviewers evaluate the same evidence.

The Philippine Data Privacy Act of 2012, Section 20, requires reasonable and appropriate organizational, physical, and technical measures. The statute published by the National Privacy Commission says controllers must ensure that “third parties processing personal information on its behalf shall implement the security measures required by this provision.” Section 20 also names processing risk, organizational size, operational complexity, privacy practices, and implementation cost as security considerations. It does not prescribe an email-security brand or pilot score.

Use that obligation to ask what message content the provider receives, which administrators can read it, how evidence is retained, and how the agreed data handling is reflected in the contract. Have your privacy officer review the actual arrangement; a security dashboard alone does not establish legal compliance.

Build the acceptance record in this order:

1. Record the configuration, licensed features, scoped mail routes, and agreed expected result for every test.
2. Preserve each test message's identifier, headers, timestamps, verdict, final action, and analyst explanation.
3. Measure missed test threats and incorrectly blocked legitimate test messages with separate denominators.
4. Exercise a reported message, an escalation, and an authorized response without using real victim data.
5. Demonstrate reversal of the pilot's routing or policy changes and verify legitimate delivery afterward.
6. Assign each failed case an owner, treatment decision, and acceptance or retest requirement.

Define support coverage and escalation authority in writing, including the handoff to any Infocentric managed-services arrangement. For help converting the test record into a scoped engagement, use Infocentric's consulting services. Approve only the behavior and ownership demonstrated by the proposed configuration; leave unsupported capabilities out of the purchasing justification.

What do Philippine buyers ask about email-security pilots?

Philippine buyers should ask what authentication proves, how pilot tests are performed, who owns response, and what privacy law requires. Use these questions to assign review responsibilities before the pilot. Confirm the feature scope and operator responsibilities against the actual contract before treating any pilot result as a deployment commitment.

Does passing DMARC mean an email is safe?

Passing DMARC means the message met the relevant domain-alignment check; it does not approve the business request inside the message. Microsoft's DMARC guidance defines the authentication test. Ask your pilot team to investigate a suspicious request from an authorized test sender and document how the request is verified.

Should the pilot use live malicious attachments?

Use authorized benign simulations and synthetic content for the proposed purchasing tests. Define the expected inspection and response before sending each sample. Do not make a real infection the price of evaluating a product. Ask the provider to document the sample's purpose, permitted actions, and limits on what the result proves.

How should we compare detection results?

Compare results against the same agreed scenarios, configuration, and mail routes, keeping threat misses separate from blocked legitimate messages. Report the numerator and denominator for each measure. Do not combine demonstration results into an estate-wide success rate. Preserve message-level evidence so your reviewer can challenge the classification and reproduce the decision.

Who should authorize mailbox response actions?

Name the person or role permitted to investigate messages, change policies, and initiate mailbox-related response before the pilot starts. Specify which actions need additional approval and which belong to identity administrators. Test the escalation with synthetic content. The contract should reflect that division instead of leaving authority to a vendor demonstration.

Does the Data Privacy Act require this product?

Section 20 of the Data Privacy Act of 2012 requires appropriate security measures rather than a named email-security product. Ask your privacy officer to review the processing arrangement and purchasing evidence. Section 20(d) also requires controllers to ensure that third parties processing personal information on their behalf implement the required security measures.