The Security Perimeter Nobody Talks About: Your Customers

Your security stack is very good at protecting you. It's less good at protecting the people who trust you.

A customer doesn't experience your firewall, your email gateway, or your endpoint protection. They experience your brand: your logo, your login page, the email that looks like it came from you. The moment an attacker builds a convincing copy of that experience on infrastructure you don't own, every control you've invested in stops applying — because the attack never touches your network at all.

The Problem: Protection That Stops at Your Walls

The scale of this is easy to underestimate until you see it in hard numbers:

• 1.5M+ domains reported for phishing in 12 months, 77% registered maliciously from day one. (Interisle Consulting, 2025)
• $2.95B lost to business and government impersonation scams in 2024 (FTC, 2024)
• 92% of S&P 500 market value now held in brand and other intangibles (Ocean Tomo, 2025)

Consider a mid-size outdoor retailer, Northfield Outfitters, selling gear at northfieldoutfitters.com with a loyalty program tied to stored payment details.

An attacker registers northfield-outfitters.com — one hyphen, an SSL certificate, and a scraped copy of the real homepage later, it's indistinguishable at a glance. An email goes out to loyalty members: “Your Rewards points are expiring — sign in to keep them.” The sender name and link text both read “Northfield Outfitters”; the actual destination doesn't. Customers who don't catch the extra hyphen log in normally, hand over their credentials and saved payment details, and move on without a second thought.

Weeks later, Northfield's support line is fielding calls about unauthorized charges. Nothing in Northfield's own systems was ever touched — but the customer doesn't know that, and often neither does the press. Three in four consumers say they'd cut ties with a brand after a security incident, even when that brand was the victim rather than the cause.

That's the uncomfortable part of brand impersonation: your security posture can be flawless and it still happens, because the vulnerability isn't in your systems. It's in how easy it is to register a domain and copy a web page. Traditional email security has no visibility into a domain that didn't exist yesterday — by the time a phishing campaign using it reaches an inbox, the fake site has often been live, and collecting credentials, for hours or days.

The Solution: Extending Protection Past the Perimeter

Mimecast Brand Exploit Protect picks up exactly where your perimeter leaves off, watching the places attackers have to show their hand before a phishing email ever goes out.

It discovers lookalike domains the moment they appear. BEP continuously scans domain registrations and newly issued SSL certificates — nearly every new site gets one — and checks each against known lookalike patterns for your brand: typosquats, bit-flips, homoglyphs, and more. northfield-outfitters.com would typically be flagged within 24 hours of registration, well before any email campaign launches.

It investigates before it alerts. A flagged domain isn't automatically an incident. BEP enriches it with WHOIS and DNS data, then crawls the live site, screenshots it, and fingerprints the content against the real brand's pages — in Northfield's case, a near-identical match. Keyword context sharpens this further, so a domain combining a brand name with “login” or “rewards” scores very differently than an unrelated, benign use of the same name.

It scores and prioritizes automatically, combining content similarity, domain popularity, and prior contact history into a single risk score — so the domains most likely to be actively phishing customers surface immediately instead of getting lost in a queue of routine registrations.

It catches cloned content in real time, through a dormant tracking snippet customers can embed on their own site; if an attacker scrapes that HTML onto a fake domain, the tracker activates the moment a real visitor lands there.

It responds fast. A 24/7 analyst team requests takedowns with hosting providers and registrars, checks whether browsers already block the site, and pushes it into Mimecast's email and web security stack so it's blocked for every protected employee immediately — even while the takedown is in progress. For Northfield, that means the cloned site is identified and moving toward takedown before the rewards-expiration email ever reaches a customer's inbox.

A human still makes the call. Automation removes the noise, but a trained analyst confirms every threat before a takedown request goes out, keeping false positives low.

What This Means for the Customers Who Trust You

Your firewall was never going to stop this — it isn't built to, and that's fine, because something else now is. BEP extends your protection to the one place your existing tools can't reach: the open internet, where your customers are the ones exposed. Threats detected out there feed directly into the email and web security you already run, managed from a single console, so your team gains visibility into attacks it previously couldn't see at all.

Brand impersonation isn't something you patch your way out of. The only real defense is watching continuously for it and acting before it reaches the people whose trust you're responsible for — customers included.
Ready to see what's impersonating your brand right now? Request a demo of Mimecast Brand Exploit Protect.

Northfield Outfitters is a fictional company used for illustration only; any resemblance to a real business is coincidental.