Mailbox risk is the security impact created when an email account contains sensitive messages, attachments, contacts, or internal references. An exposed mailbox can reveal passwords, reset links, business plans, invoices, legal details, or the names and relationships of employees and partners. Even without a full system breach, access to email can give an attacker a map of the organization.
This matters because email is often both a storage system and a control channel. Attackers use stolen mailboxes for reconnaissance, impersonation, and follow-on compromise such as phishing, business email compromise, and account takeovers. Defenders measure mailbox risk by looking at message sensitivity, mailbox permissions, forwarding rules, retention settings, and whether an exposed account can be used to pivot into other services. Limiting access, enforcing MFA, monitoring unusual login and export activity, and reducing exposed internal references all lower the impact.