A ticket queue has a number on it, and the number moves all day. Every malicious attachment that reaches an inbox adds one before it becomes anything else: a user forwards it, a tier-one technician opens the ticket, reads the headers, detonates the file, writes back, and closes it. On a per-seat contract, nobody pays for that work but the provider. That is the cost an email security layer actually controls. A managed email service has almost no marginal cost except technician time: triage, quarantine questions, false-positive releases, onboarding each new tenant. So the useful measure of an email product is what it removes from the queue, not what it catches. What The Queue Is Made Of Malware is the smaller share of what lands on a tier-one email desk. Most of it is phishing, impersonation, a payment-detail change from a supplier the client already trusts, and the forward that says "is this real?" The malware share still matters, because it is the share a provider can close almost completely. A modern email layer should stop the attachment before it reaches the mailbox, so nobody has to detonate it and no tickets have to be filed. The rest of the queue, however, does not vanish. Where The Hours Actually Go Prevented tickets are invisible. Nobody invoices for them, and no client sees the hour that did not happen. The number worth knowing is email tickets per seat per month, across the whole book, split by what caused them: attachment, phishing or impersonation, quarantine release, "is this real?" Pulled once, it becomes the baseline every later decision about the email line gets judged against. A provider who knows that number can tell a client what changed. A provider who does not can only tell them what was blocked, and blocked counts are the metric every vendor already reports. Retention Runs On The Same Math Backup is invisible until it is needed; email is where the client watches you work. Clients notice slow responses long before they notice a stopped attack, and responses slow down when the queue is full of mail that should have ended upstream. Fewer arrivals means a shorter queue, and a shorter queue is the cheapest service improvement a provider can buy, because it costs no headcount and shows up in every other ticket's response time. It also changes what there is to say at the quarterly review. "We blocked 4,000 messages" is a vendor's line. "Your team forwarded a third fewer messages to us this quarter, and here is what we did with the time" is a provider's. What To Tell The Client Most of what we do for your mailboxes now happens before anyone on your side sees it. When a malicious attachment is stopped before the inbox, nobody forwards it, nobody waits for us to look at it, and nobody loses an hour to it. We are tuning this layer for fewer email tickets from your team and faster answers from us on everything else. You will see fewer "is this real?" forwards, and that is the measure we will report on. The Next Ticket The next class of email ticket is already forming, and it will not come from a user asking whether something is real. The UK's National Cyber Security Centre wrote in December 2025 that current large language models "simply do not enforce a security boundary between instructions and data inside a prompt." An inbound message is data until an assistant reads it; then it can be instructions. There is no rate for that yet that belongs in front of a client. When it lands, it will land at the same desk, on the same per-seat contract — and there still will not be a number for it until someone starts counting.
You can skip this ad in 5 seconds