Many organizations feel secure in the knowledge that their email gateway is rewriting all of the harmful links targeting their employees. Link rewriting is a common technique that involves encoding URLs sent via email into a link that redirects the user to the gateway’s own servers. These servers contain some unique codes that then track the user and perform later checks to determine whether the link is malicious.
This blog reveals why the sense of protection this gives is a fallacy, and how rewriting links does not equate to protecting the end user from actual harm. In fact, gateways’ reliance on this technique is actually an indicator of one of their fundamental flaws: their reliance on rules and signatures of previously recognized threats, and their consequent inability to stop threats on the first encounter. The reason these tools pre-emptively rewrite links is so they can make a determination later on: with the link now pointing to their own servers, they can leverage their updated assessment of that link and block a malicious site, once more information has become available (often once ‘patient zero’ has become infected; and the damage is already done).
Email security that recognizes and blocks threats on the first encounter has no need to rewrite every link.
How to measure success
If the sheer number of links rewritten is to be our measure of success, then traditional gateways win every time. For instance, Mimecast will usually rewrite 100% of the harmful links that Antigena Email locks. In fact, it rewrites nearly 100% of all links. That even includes links pointing to trusted websites like LinkedIn and Twitter, and even emails containing links to the recipient’s own website. So when tim.cook[at]apple.com receives a link to apple.com, for example, ‘mimecast.com’ will still dominate the URL.
Some organizations suffering from low first-encounter catch rates with their gateways have responded by increasing employee education: training the human to spot the giveaways of a phishing email. With email attacks getting more targeted and sophisticated, humans should never be considered the last line of defense, and rewriting links makes the situation even worse. If you’re training your users to watch which links they’re clicking, and every one of those links reads ‘mimecast.com’, how are your users supposed to learn what’s good, bad, or sketchy when every URL looks the same?
Moreover, when Mimecast’s URL gateway is down, these rewritten links don’t work (and the same applies to protected attachments). This results in business downtime which is intolerable for businesses in these critical and challenging times.
We can see the effect of blanket rewriting through Darktrace’s user interface, which shows us the frequency of rewritten links over time. Looking back over three days, this particular customer – who was trialing Antigena Email alongside Mimecast, received 155,008 emails containing rewritten links. Of those, 1,478 were anomalous, and Darktrace’s AI acted to immediately lock those links, protecting even the first recipient from harm. The remaining 153,530 links were all unnecessarily rewritten.
Figure 1: Over 155,000 inbound emails contained rewritten Mimecast links
If it comes to actually stopping the threat when a user goes to click that rewritten link, gateway tools fail. Their reliance on legacy checks like reputation, deny-lists, and rules and signatures mean that malicious content will sometimes sit for days or weeks without any meaningful action, as the technology requires at least one – and usually many – ‘patient zeros’ before determining a URL or an attachment as malicious, and updating their deny-lists.
Let’s look at the case of an attack launched from entirely new infrastructure: from a freshly purchased domain, and containing a newly created malicious payload. None of the typical metrics legacy tools search for appear as malicious, and so of course, the threat gets through, and ‘patient zero’ is infected.
Figure 2: ‘Patient Zero’ denotes the first victim of an email attack.
It inevitably takes time for the malicious link to be recognized as malicious, and for that to be reported. By this point, large swathes of the workforce have also become infected. We can call this the ‘time to detection’.
Figure 3: The time to detection
As legacy tools then update their lists in recognition of the attack, the malware continues to infect the organization, with more users engaging in the contents of the email.
Figure 4: The legacy tool reacts
Finally, the legacy tool reacts, updating its deny-list and providing substantive action to protect the end user from harm. By this point, hundreds of users across multiple organizations may have interacted with the links in some way.
Figure 5: Many ‘patient zeros’ are required before the threat is deny-listed
Email gateways’ reliance on rewriting links is directly related to their legacy approach to detection. They do it so that later down the line, when they have updated information about a potential attack, they can take action. Until then, it’s just a rewritten link, and if clicked on, it will bring the user to whatever website was hiding underneath it.
These links are also rewritten in an attempt to grasp an understanding of what user network behavior looks like. But far from giving an accurate or in-depth picture of network activity, this method barely scratches the surface of the wider behaviors of users across the organization.
Alongside Darktrace’s Enterprise Immune System, Antigena Email can pull these insights directly from a unified, central AI engine that has complete and direct visibility over an organization’s entire digital estate – not just links accessed from emails, but network activity as a whole – and not a makeshift version where it is assumed people only visit links through emails. It also pulls insights from user behavior in the cloud and across SaaS applications – from Salesforce to Microsoft Teams.
Taking real action in real time
While gateways rewrite everything in order to leave the door open to make assessments later on, Darktrace is able to take action when it needs to – before the email poses a threat in the inbox. The technology is uniquely able to do this due to its high success rates for malicious emails seen on first encounter. And it’s able to achieve such high success rates because it takes a much more sophisticated approach to detection that uses AI to catch a threat – regardless of whether or not that threat has been seen before.
Darktrace’s understanding of ‘normal’ for the human behind email communications allows it to not only detect subtle deviations that are indicative of a cyber-threat, but respond to that threat at the point of delivery. This response is targeted, proportionate and non-disruptive, and varies according to the nature of the attack. While Darktrace’s unsupervised machine learning can accurately identify deviations from ‘normal’, its supervised machine learning models are able to classify the intention behind the email; what the attacker is trying to do (extort information, solicit a payment, harvest credentials, or convince the user to download a malicious attachment).
Crucially, organizations trialing both approaches to security find that Antigena Email consistently identifies threats that Mimecast and other tools miss. With the scale and sophistication of email attacks growing, the need for a proactive and modern approach to email security is paramount. Organizations need to ensure they are measuring their sense of protection with the right yardstick, and adopt a technology that can take meaningful action before damage is done.
![Model alert in Darktrace / NETWORK showing the repeated SSL connections to a rare external Self-Signed endpoint, 185.49.126[.]50.](https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/6823ad5f8454ff831da3182a_Screenshot%202025-05-13%20at%201.35.56%E2%80%AFPM.png)
![Darktrace’s detection of repeated connections to the suspicious IP address 185.49.126[.]50 over port 6606, indicative of beaconing behavior.](https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/6823adc5ac5c997938babf30_Screenshot%202025-05-13%20at%201.38.15%E2%80%AFPM.png)
![Darktrace's Autonomous Response actions blocking the suspicious IP address,185.49.126[.]50.](https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/6825268603a7a2b1459c9fea_Figure%204.png)
![Darktrace’s detection of connections to the suspicious endpoint 195.26.255[.]81, where the default ports (6606, 7707, and 8808) for AsyncRAT were observed.](https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/6823ae6e325a742b23ef6e6d_Screenshot%202025-05-13%20at%201.41.09%E2%80%AFPM.png)
![Darktrace's detection of a connection to the suspicious IP address 195.26.255[.]81 and the domain name identified under the common name (CN) of a certificate as AsyncRAT Server](https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/6823aea233fc6374c1432604_Screenshot%202025-05-13%20at%201.42.00%E2%80%AFPM.png)
![Darktrace’s Autonomous Response applied a total of nine actions against the IP address 191.96.207[.]246 and the domain 'kashuub[.]com', successfully blocking the connections.](https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/6823af1b3cbc7734f47fc15b_Screenshot%202025-05-13%20at%201.43.56%E2%80%AFPM.png)
