For almost a year, service providers and their clients have been the focus of spear-phishing and other intrusions that have resulted in large-scale direct and indirect data breaches. It's scary stuff, and the worst of it is far from over. Largely, these breaches have come in two flavors: system intrusion with direct compromise of data; and client credential compromise, whereby a bad actor gains control of a valid and trusted account at an email service provider and uses it to send malicious content.