One Agency Inbox. Dozens of Client Accounts at Risk.

Marketing and PR agency inboxes sit at the intersection of every client platform you touch. The inbox itself may not hold every password. Most agencies use password managers, and most platforms are behind MFA. But the inbox still receives every magic sign-in link, every platform collaborator invite, every “approve this new user” request, every password reset confirmation, and every confidential brief for the launch next week. It is the hub. An attacker inside an agency inbox can trigger password resets, accept platform invites, read sensitive campaign plans, and impersonate the agency to clients from a real domain. The password vault stays closed. The access cascades anyway.

Attackers know this. Compromising one agency inbox is functionally equivalent to reaching every client platform the agency touches. Which is why agencies are targeted disproportionately for their size, and why the “we’re too small to be a target” argument stopped being true some time around 2018.

Why Agencies Are a Target

The reasoning, from the attacker’s side, is clean. An enterprise security team at a Fortune 500 brand is hard to social-engineer. A twelve-person agency managing that brand’s Instagram is much easier. Same access, lower friction, weaker defenses.

Agency inboxes typically have no dedicated IT. The team is designers, strategists, copywriters, producers, account managers. Security is whoever reads the Wirecutter article about password managers. The tools in use are Gmail or Google Workspace, shared Slack, shared Notion, and one password manager (hopefully).

Meanwhile, every single campaign runs briefs, approvals, and platform access flows through email. Clients send NDAs and launch timelines. Platforms send magic links and collaborator invites. Vendors send invoices with wire instructions. All through the inbox. A compromise of that inbox is not just a breach of your agency. It reaches every client you work for.

The Specific Attacks

Client impersonation. An attacker spoofs a client’s email domain and sends a “quick favor, can you pause the Instagram campaign and update the ad account billing” request. The junior account manager, trying to be responsive, makes the change. The attacker now has the budget redirected or the account handed over.

Platform magic-link harvesting. Your team works with a dozen platforms that send sign-in magic links by email. An attacker who gets into your inbox gets into all of them, sequentially.

Phishing of the agency itself. Fake-vendor invoices, fake “new project” inquiries with malware attachments disguised as briefs, fake “loved your work” emails asking for a portfolio link that routes through a credential harvester.

Supplier impersonation. Spoofed emails from your freelancer network or production vendors asking for updated payment info.

Each one looks routine. None of them are. And AI-generated phishing volume has risen sharply in the last year, which means the quality of the spoof emails your team is being asked to catch is higher every quarter.

Why Spam Filters Are Not the Answer

Standard Gmail and Outlook filters are tuned for mass fraud. The client-impersonation email, the fake-brief email, the lookalike-domain vendor invoice, none of them trip any of the signals those filters look for. They are short, clean, professional emails from plausible-looking addresses. They get delivered.

Training helps marginally. “Verify every credential request out of band.” “Never click a magic link unless you just requested it.” “Always check the From: domain carefully.” Useful rules, nobody follows them on a Friday at 5pm the week of a launch.

The structural problem: reaching an agency inbox costs the attacker nothing. Until that changes, the economics of targeting agencies keep getting better for them.

The Sincerity Test for Agency Life

Rythm puts a bouncer on your Gmail or Outlook inbox. Known senders walk right in. Everyone else either pays a small cover charge you set (about four cents by default) or their email waits in a separate folder for you to review.

Every client, every collaborator, every platform sender, every vendor you have paid, every creator you have briefed, is on your guest list automatically. Rythm builds the list from your existing contacts, sent folder, and inbox activity at setup. Your day-to-day inbox does not change.

An unknown sender impersonating a client from a lookalike domain cannot slip a “pause the campaign and hand over the ad account” message into your main inbox for free. That domain is not on your guest list. It has never been. To reach you, the attacker either pays (leaving a trail and arriving in your inbox labeled PAID, where a credential-change request from an unfamiliar address draws exactly the scrutiny it should) or the message goes to the review folder, where “unknown sender requesting credential change” is a very different-looking email than it would be buried in the normal thread.

The filter is sender intention. Not sender content. This is what economic filtering actually is.

What Changes on the New-Business Side

Agencies worry first about missing inbound leads. Understandable. New business is the lifeblood.

In practice, the cover charge does not block real prospects. A founder, marketing director, or brand manager who wants to hire your agency will pay a nickel without thought. The cost is laughable next to the engagement size. Their email lands in your inbox marked PAID, they are added to your guest list permanently, and the thread continues like any other.

What stops paying is the cold outreach industry that targets agencies. “We help agencies scale with our automated lead gen tool.” “Are you open to a partnership?” “We loved your recent work on…” None of these pay four cents per recipient across 20,000 agencies. They churn through at zero cost. When the cost goes up, their margin collapses, and they move on.

The filter separates the founder with a real project from the SEO outreach tool with a template. Which is the exact distinction your agency already makes manually, just automated and structural.

What It Costs

$1.65 per mailbox per month. Cancel anytime. Works with Gmail, Google Workspace, Outlook, and Microsoft 365. Setup takes about twelve minutes per user.

The architecture is non-custodial: no email content stored, no funds held, no data at rest that could become a breach vector. Cover charge payments move peer-to-peer from sender to your own Lightning wallet. Rythm is never in the money path.

For an agency with ten people, that is $16.50 per month for the whole team. Compare that to the cost of one hijacked Instagram account, one misdirected ad budget, or one client relationship ended because someone on your team clicked the wrong magic link.

The Realistic Agency Case

Your creative work is the product. Your client trust is the moat. The email inbox sits in the middle, and it is the softest attack surface in the whole operation.

Fixing it does not require a full security team, a $40,000 Proofpoint contract, or a training program nobody has time for. It requires one structural change: unknown senders can no longer reach the inbox on the same terms as known ones. A twelve-minute setup and $20 a year per seat.

Every client whose platform access flows through your inbox deserves that upgrade. And so does your agency.