Security is no longer defined by transport paths or identities, but by the functional role within the process context.
Security is no longer defined by transport paths or identities, but by the functional role within the process context.
Security is no longer defined by transport paths or identities, but by the functional role within the process context.
Why eMail-Security Fails
Despite advanced protection mechanisms, phishing, social engineering, and compromised user accounts remain among the most successful attack vectors.
The reason lies in the underlying trust model. Traditional e-mail security is based on identities, credentials, and transport paths. As long as these elements appear legitimate, malicious communication can remain undetected.
As a result, trust is assigned to the sender and the message, rather than to the business context in which the communication occur.
Innovation trough Process Engineering
Conventional e-mail security asks: Who sent the message? We ask: Why does this communication exist at this point in the process? Instead of viewing business processes as mere sequences of activities, we understand them as dynamic spaces of communication.
Every communication becomes legitimate only if it can be fully justified by its role, context, and purpose within a defined business process. What cannot be justified within the process context does not exist.
Communication must be legitimized through a process
In conventional e-mail systems, trust is assigned to identities, credentials, and transport paths. In a process-justified communication model, trust is assigned to the process itself.
- Processes define which communication is permitted
Roles define which actions are allowed - Identities provide traceability, not legitimacy
- Messages without a valid business context have no operational effect
The Change from Identity to Role-Model
In traditional systems, an identity holds rights. In our model, only the role within a process has an effect.
A role describes the business function of a participant in a specific process step (Approver, Orderer, Reviewer). It is not the person themselves, but their currently authorized role that determines the effect a communication may have. Even if an attacker compromises a user account, this does not grant them the ability to act. This makes identity theft virtually worthless from an economic standpoint.
Security as a feature of the process architecture
Most security solutions attempt to detect malicious communication. We prevent unauthorized communication from ever becoming part of the system. Instead of detecting attacks, we define processes that specify which communication is permitted.
This way, secure email communication becomes not just an additional layer of protection—but an inherent feature of the business process itself.
Learn more about
our Use Cases
Regulating Complex AI Systems with Process Engineering
AiGC is an executive meta-platform within agent-based AI architectures—the “ruler of rulers.” It monitors all agent actions in real time, evaluates behavior against defined policies, and actively intervenes when necessary by adjusting, stopping, or replacing.
Learn more about Process Engineering
Instead of viewing processes as mere sequences of steps, we understand them as dynamic spaces of communication. Every communication is valid only if it can be fully explained—in terms of role, context, and purpose.
The break with tradition: Security is no longer imposed from the outside, but arises continuously from consistency within the process itself. What cannot be justified does not exist.
Sign up for our Newsletter
Stay informed about process engineering!
Send a Message
Don’t hesitate to ask any questions