The code and the court: Why your email security thinks like Napoleon

In 1804, Napoleon gave France a code that much of the world still runs on. The Code civil replaced a tangle of local customs with a single written statute: orderly and knowable. In that tradition, the judge’s job, in Montesquieu’s phrase, is to be the mouth of the law, nothing more. Certainty was the point. Certainty has a cost. A codified system is only as current as its code. When the world produces something the code did not anticipate — a new technology, a new fraud — there is no statute to apply, and everyone waits for someone to write one. Your email security works exactly this way. That is the problem. Security by statute A signature is a statute. Someone observes an attack, writes a rule that describes it, and from that moment you are protected against that attack and its close relatives. It is fast, certain, and blind to anything the code has not been written to see. Signatures alone were never enough, so the industry made the code bigger. Anomaly detection and behavioral models are a thicker statute book, trained on what already happened and scoring how far a message deviates from it. More sophisticated than a signature, but not a different philosophy. A zero-day is a crime with no statute. The strongest evidence against codified defense is not the attack that fails a check. It is the attack that passes every one. When a supplier’s mailbox is compromised, the message arrives from a real domain, with valid credentials and earned reputation. Every check comes back clean because the infrastructure is genuine. Verizon’s 2026 Data Breach Investigations Report found that breaches involving a third party now account for 48% of the total, up 60% in a single year. Authentication did exactly what it measures: it confirmed the letter came from who it said, and had no rule for whether it should be believed. The code was consulted. The code said valid. The message was a theft in progress. Attackers understand this. A codified defense is cheap to walk around. You do not break the code; you do something it was never written to cover. The FBI’s 2025 Internet Crime Report put business email compromise losses above $3 billion in a single year, much of it carried by messages that broke no rule because no rule described them. The other tradition The English-speaking world chose a different system. Common law does not always wait for the legislature. A judge facing a situation no statute anticipated can reason from principle and precedent to a verdict. It adapts case by case. It is not simply a code that has to be rewritten. It is a court that knows how to weigh a new set of facts. That is the difference between detecting and reasoning. The fair objection is that a reasoning system also learns from the past. True. But there is a difference between matching a case to a stored pattern and applying a principle to a case you have never seen. A judge who has never encountered your particular dispute still knows how to weigh evidence. None of this means throwing out the code. Most mail is open and shut and should be settled that way in milliseconds. You keep the fast rule for the easy calls and save a full hearing for the contested ones. A court can also answer a question a code struggles with: why. A codified system can say “this matched” or “this deviated.” A verdict can cite its evidence: what the sender actually is, whether the relationship supports the request, what the message is asking for. You do not have to trust the reasoning. You check the evidence, because a ruling stands or falls on whether its facts hold up, not on the private thoughts of the judge. It is the opposite of a black box: a decision you can read, challenge, and overturn. None of this retreats from zero trust. Zero trust governs access, who gets in and what they can touch, and assumes nothing. This is about the verdict, whether a message is what it claims to be, and there the posture is not to presume guilt or innocence but to let the evidence decide. The court of last resort For the highest stakes matters, a mature legal system does not let the machinery decide alone. In security, some decisions belong with the person whose money is about to move. When a message asks for a wire, a change to vendor banking details or a payroll redirect, the right design does not render a silent verdict and hope. It escalates and asks the owner to approve the action itself. Reasoning handles the general docket. The human is the court of last resort, reserved for the decisions that deserve one. Match the process to the stakes. No analogy is perfect. Real judges in both traditions do more than this, and civil-law systems evolve through their own doctrine. The question worth ending on For most of this industry’s history, there was no choice, because machines could apply a code but could not weigh evidence and reason for a judgment. That is no longer true. There is a simple way to find out which system you are running. Ask your team how many attacks that reached a user came from infrastructure you already trust: a compromised vendor, a real account, a genuine DocuSign or Microsoft notification bent to a purpose it was never meant for. If that number is high, your defenses are not failing to enforce the code. They are enforcing it perfectly; against threats the code was never written to describe. So, the question is not whether your defenses are up to date. A code is always, by definition, up to date with yesterday. The question is whether your security is a code or a court, and whether it can rule on the case it has never seen, because that is the only case that was ever going to hurt you.