PCES case studies
PCES · Put your knowledge to work in context.
The Professional Cloud Email Security (PCES) credential is an independent, vendor-neutral certification aimed at practitioners who defend email as it actually runs today: through cloud platforms, APIs, and hybrid gateways rather than a single on-premises appliance. It suits security engineers, email administrators, SOC analysts who triage reported mail, and cloud architects responsible for mail flow, authentication, and data protection. The PCES case studies are 5 cases and about 3,054 words.
1DMARC Enforcement at a Retailer With a Rewriting CRM
Northwind Retail (northwind.example) has used DMARC p=none with rua reporting for 20 months. Marketing sends 60% of volume through a CRM that rewrites From to a bounce domain, then DKIM-signs with its own key; the CRM's SPF is not aligned.
616 words, about 3 min2Mail Loop After a Shared-Domain Migration
Fabrikam (fabrikam.example) runs Exchange Online for 8,000 users. Inbound mail flows through a third-party secure email gateway (SEG), then to Exchange Online; outbound goes directly from Exchange Online.
634 words, about 3 min3Aggressive Impersonation Filtering Collides With Operations
Contoso Health (contoso.example) enabled a new cloud email filtering policy with aggressive impersonation protection, DMARC quarantine for all unauthenticated mail, and a block list of 300 lookalike domains. Within 48 hours, the help desk logs 600 tickets: appointment reminders from a scheduling SaaS are quarantined; a partner hospital's legitimate invoices are blocked because their domain is on the lookalike list; and 30 users received a BEC message from a Gmail account displaying the CFO's name, asking for gift-card purchases.
601 words, about 3 min4Business Email Compromise With an Active Mailbox
At 09:10 on a Friday, a finance analyst at Tailspin (tailspin.example) reports that a vendor's email thread now shows a different bank account. Investigation finds the analyst's Microsoft 365 account was accessed from an unfamiliar Nigerian IP using a valid password and no MFA prompt.
586 words, about 3 min5DLP, Encryption, and Legal Hold in a Financial Firm
Meridian Financial (meridian.example) has 6,000 users on Google Workspace. Compliance requires seven-year retention for client communications, and legal has placed 40 custodians on hold for a regulatory matter.
617 words, about 3 min