Integrating Cyber Threat Intelligence into Email Gateway Architectures for Phishing and Ransomware Detection and Prevention

Abstract

Email remains a major Initial Access vector for phishing and ransomware attacks, requiring security mechanisms that can combine multiple sources of threat evidence before malicious content reaches end users. Modern commercial email gateways already incorporate antivirus, reputation-based filtering, email authentication, and vendor-provided threat-intelligence mechanisms. However, their correlation logic, scoring criteria, decision thresholds, and automated response workflows are often proprietary or insufficiently documented. Moreover, transparent evaluations of the incremental benefit provided by external CTI enrichment and unified Indicator of Compromise (IoC) and Indicator of Attack (IoA) correlation remain limited. To address this gap, this study presents and experimentally evaluates a transparent CTI-supported email gateway workflow that integrates external intelligence feeds, IoC/IoA correlation, contextual threat scoring, predefined decision thresholds, and automated response actions. The proposed configuration was compared with a commercial baseline using the same vendor-native security controls in an isolated VMware ESXi-based environment. The evaluation included 1000 emails comprising 500 benign emails, 200 emails containing ransomware attachments, and 300 emails containing phishing URLs. The CTI-supported configuration achieved an overall detection rate of 98.8%, compared with 64.2% for the commercial baseline. Phishing URL and ransomware attachment detection rates reached 99.3% and 98.0%, respectively, while the false positive rate decreased from 4.5% to 1.2%. In the evaluated scenarios, the CTI-supported architecture interrupted the modeled attack chain at the Initial Access stage, demonstrating the measurable benefit of external CTI enrichment and unified correlation beyond the gateway’s native controls.