Mailbox retention is the period during which email content is kept after it is no longer actively used. In practice, this can include messages in a user’s inbox, archived folders, backup sets, and sometimes indexed copies in monitoring or e-discovery systems.
It matters in cyber security because retained mail can preserve sensitive data long after a person leaves or a message is deleted. That creates a larger exposure window for attackers, insiders, and overly broad administrator access. Good retention controls help limit what data exists, where it is stored, and who can reach it. In real defenses, teams set retention schedules, enforce deletion or archival rules, protect backups, and log access to former-employee mailboxes. In attacks, threat actors often target mail archives because they contain credentials, business context, and personal information that can be reused for fraud or lateral movement.