Over the past few years, the recognition and acceptance of cloud-based applications has gained a lot of momentum. Commercial applications that were initially installed inside corporate on-premises server rooms are now hosted on cloud infrastructures. Software applications are provided in the form of commercial services that are accessible anytime, anywhere. Cloud-based solutions also eliminate the need for regular maintenance-related activities, unnecessary downtimes or outages, attention to back-ups or regular infrastructure upgrades. Commercial applications that were initially installed inside corporate server rooms are now hosted on cloud infrastructures, accessible anytime, anywhere. However, mitigating cloud-based security risks requires that service providers and corporate users adopt a universal approach for ensuring that the right solution is in place, especially when application services used over insecure Internet connections raise new risks. Akashdeep Bhardwaj and Sam Goundar examine the kinds of threats facing cloud-based email systems and the mitigations available.