Don’t use corporate email for your personal life

This guidance explains why using corporate email addresses for non-work services increases organizational risk by enabling credential reuse attacks (credential stuffing/spraying, brute force), social engineering and phishing, account lockout DoS, and reputational exposure via OSINT, and recommends countermeasures. It advises enforcing Acceptable Use Policies, filtering inbound mail from certain domains to discourage non-business use, and mandating MFA (TOTP/FIDO) with conditional access on externally accessible systems to reduce account compromise risk.