> ## Content Index
> Fetch the complete content index at: https://insights.securesalt.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# The Fox Guarding the Henhouse
- URL: https://insights.securesalt.com/articles/the-fox-guarding-the-henhouse/
- Published: 2026-10-26T02:40:00.000Z
- Updated: 2026-10-27T17:26:12.000Z
- Description: Recipient advocacy: a say in the assurance behind every message.
- Author: Chris Econn
- Tags: #needs-refinement, Articles

Several years ago, a company I worked for conducted an authorized phishing simulation, carried out by security practitioners formally recognized as among the best in the world. Roughly 75% of employees clicked an invoice email, although only one person had a business reason to act on it.

The lesson was then, as it often is now, to train employees to inspect links and investigate senders. But that skips a simpler question: “Is this something I should be handling at all?”

Security policy needs to make sense in ordinary business. It cannot substitute for a clear job description. If employees don't know what deserves their time, their inbox becomes an invitation to exercise morbid curiosity—and click.

And once someone has decided a message doesn't deserve their attention, why should they have to keep making that decision?That thinking helped shape Salt Mail. Dismiss an unwanted invoice message once, and Salt Mail can learn that preference for future relevant machine-generated mail.

But an invoice you have no reason to receive is the easier problem. What about a personal message you have every reason to receive? A colleague, a customer, or a worthwhile new connection deserves consideration. You should be able to welcome that conversation without becoming an investigator.

Google and Microsoft provide both the email accounts and many of the controls we rely on to secure them. Those controls do important work. But protecting an account and establishing what its recipient should trust are different responsibilities.

Suppose every account holder had to scan a passport tomorrow. It might establish who opened the account. It would not establish who is using it now, whether they wrote this message, or whether they have authority to make this particular request.

Authenticating access to an account does not settle those questions. The recipient still needs assurance appropriate to what they are being asked to do.

That is where recipient advocacy begins.

People have a responsibility to exercise judgment. The system has a responsibility to obtain and evaluate assurance without making every recipient perform forensics. The person receiving a message bears the consequences of trusting it. They should have a say in the assurance required before it reaches them.

We believe this should be the standard: the recipient sets the requirement, and the system does the verification work on their behalf.That is what we are building with Salt Mail.

**Read next:** [**Your inbox should not become a queue of investigations**](https://insights.securesalt.com/articles/your-inbox-should-not-become-a-queue-of-investigations/)