The Digest Is a Door: Why Quarantine Summaries Deserve Zero Trust

Every morning, thousands of UK inboxes receive a tidy little summary of messages that never made it to the inbox. It lists a few senders, a few subjects, and a button or two: release, block, allow sender. The quarantine digest is supposed to be a safety net. Too often, it is also a training exercise in clicking a link because an email told you to.

That is the awkward bit. A digest is a notification about email security, delivered by email, asking you to make a security decision by clicking. Attackers do not need to invent a new trick when the existing workflow already looks like a form. They just need to copy the wrapper.

The helpful email that teaches the wrong reflex

Quarantine summaries exist for a good reason. Filters make mistakes. A client sends a quote from a new domain, a supplier changes their bulk-mail provider, or a newsletter gets caught because it looks a bit too much like the hundreds of other newsletters nobody reads. Without a digest, those messages sit in limbo until someone logs into the admin console.

The problem is not that digests exist. The problem is that they normalise a habit: open email, scan summary, click release. That habit is exactly what a phishing email wants. Once a user has released three legitimate messages this week, the fourth release link does not feel like a security event. It feels like admin.

What a real digest looks like, and where trust leaks

Most digests follow a predictable pattern. They show the sender address, the subject line, the reason for quarantine, and an action link. Some include a preview, a report button, or a line telling you to contact IT. Vendors such as Microsoft 365, Google Workspace, Mimecast, Proofpoint, Barracuda and Sophos all have their own house style, but the shape is similar: a compact table of held messages and a call to action.

That predictability is useful for users and useful for attackers. A convincing fake digest only needs a logo, a footer, a muted colour palette, and a sentence about messages being held. The sender address can be a lookalike domain. The release button can point to a credential-harvesting page. The whole thing can arrive at 8:05am, just before the real digest, when nobody is paying close attention.

The tell is rarely the logo. It is the destination. A genuine digest should send you to your filter console or your tenant, and that journey should require a proper sign-in. If a release link opens a page that asks for your Microsoft 365 password on a domain that is not Microsoft, stop. If it asks you to confirm your email password to release a message, stop. If the page looks like your webmail login but the URL is a string of random words, stop.

The pressures attackers add

Phishing works through pressure, and quarantine-themed lures have a few reliable levers. The first is urgency: a message from payroll, an invoice, a delivery update, a notice from HMRC. The second is authority: the digest appears to come from IT or from the filter itself. The third is familiarity: the layout matches something the user sees every day.

The fourth lever is quieter. It is process. A digest does not look like a scam because it looks like a control panel. It uses words such as release, allow, blocked, quarantined. It implies that the user is managing a system. That is a powerful disguise. UK users have been trained to distrust unexpected attachments and strange links, but a quarantine summary feels internal. It feels like the plumbing.

A ten-minute audit for your own digest

Start with the real thing. Open your filter console and compare it with the digest your users receive. Check the following:

• Does the digest link to your actual tenant domain, or to a third-party tracking domain? Both can be legitimate, but users need to know the difference.
• Does releasing a message require a sign-in with MFA, or can anyone with the link release it? A one-click release is convenient and risky.
• Can users add senders to an allow list directly from the digest? If so, what is the review process? An allow-sender link is a phishing shortcut if it is too easy to use.
• How often is the digest sent? Daily digests create daily clicking practice. Weekly may be enough for many teams.
• Is the digest branding customisable? If your logo and colours appear in it, attackers can copy them. That does not mean remove branding; it means teach users that branding is not verification.
• Is there a clear route to report a suspicious digest? The report button should be easy to find and should not look like the release button.

For smaller UK organisations without a dedicated security team, the most useful change is often the simplest: tell staff to ignore links in the digest and go to the console via a bookmark. If that sounds heavy-handed, compare it with the alternative. A user who habitually clicks release links is one well-crafted fake away from handing over credentials.

Teaching staff to treat the digest as untrusted input

The briefing does not need to be long. It needs to be specific. A quarantine digest is a notification, not a control panel. It tells you that something is waiting. It does not prove that the message is safe, and it does not prove that the digest itself is genuine.

Give people three rules. First, if a digest asks you to sign in, close it and open your mail admin page from a bookmark. Second, never release a message just because the display name looks familiar; check the actual address. Third, report odd digests to IT rather than deleting them, because a wave of fake quarantine emails is useful intelligence.

It also helps to explain the difference between report and release. Reporting a message feeds the filter. Releasing a message tells the filter that it was wrong. Those are opposite actions, and a fake digest wants users to confuse them.

The checklist before the next digest lands

• Confirm the real digest sender domain and share it with staff.
• Check every release and allow-sender link in a test digest.
• Require MFA for release actions where your platform allows it.
• Reduce digest frequency if daily summaries are creating click fatigue.
• Add a short explainer to onboarding and intranet pages.
• Encourage reporting through NCSC's Suspicious Email Reporting Service for scams, and through your internal IT route for suspected phishing.

Quarantine digests are not going away, and they should not. They are a useful escape hatch for legitimate mail. But a digest is still an email from outside your trust boundary, even when it carries your filter's logo. Treat it like one. The release button should be a deliberate trip to a known console, not a reflex trained by a helpful summary.