Exchange allows users to access their own e-mail accounts via a browser. This involves the use of the Internet Information Services (IIS), which are an integral part of the Windows operating system. If this functionality is planned poorly and configured improperly, it may allow uncontrolled access to the internal network from the outside.

If e-mails are accessed via the Internet with a browser, this poses very significant risks. Despite not having direct access to an organisation’s network, attackers may access e-mails and thereby gain access to e-mail addresses and content, misuse e-mail features, send spam e-mails, or gain access to the organisation's internal information.