While an unauthenticated attacker can easily be discovered attempting to gain access to an organization's systems, it is nearly impossible to differentiate an authenticated user, and an authenticated attacker after access is already granted.

Every single day there is countless databases being leaked online from major and minor organizations all over the world. Some are large enough to make it into the news, some are too small, but many simply go unnoticed.

Attackers scour the internet and the darkweb for these golden gems. You can be assured that every email that is associated with your organization is being tested against any of your login forms exposed to the internet.

'Credential Stuffing' or an automated injection of breached username/password pairs in order to fraudulently gain access to user accounts, is a relatively new style of attack.

The only way to prevent an attacker from gaining authenticated access to your networks is to know about the leaked credentials before an attacker has a chance to use them.

Many times the credentials leaked online that happen to be associated with an employee emails, are not valid for logging into corporate networks.

While this might prevent Credential Stuffing, a dedicated attacker can still learn a lot from leaked credentials.

Such as if a user has a habit to add a single digit or increment a digit to a common password for different services.

This is known as Predicting Password Patterns, and can be just as disastrous if this is a habit of an employee and can lead to authenticated access.

A less well known but still relevant threat to an organization is what other services an employee is using their company email for.

Some services such as LinkedIn are generally acceptable but these carry their own risks. Such as an attacker taking over an account of a third party site and using it to abuse the trust the account carries.

Additionally, employees sometimes feel they can use company emails on any service they like, even more questionable services such as dating sites or pornographic sites. This should never be the case. ...

Company emails are just that, company emails and should only ever be used for company related correspondence.