Every filter lets something through eventually. A message looks harmless on arrival, the link still points to an empty page, the attachment is unknown to the sandbox. An hour later the page is a perfect copy of your Microsoft login. By then the message is already sitting in 40 mailboxes.
At that point, what matters is no longer whether the filter was perfect. What matters is how fast you get rid of the message. This post shows how that works in the SecTepe Mail Security Gateway.
Why attacks only show up after delivery
- Late links: Attackers send messages with links to pages that are harmless on arrival. Only later do they redirect to a phishing page.
- Late insight: The sandbox raises an alert after a few minutes. Or a campaign only becomes known when the first employees report it.
- Targeted attacks: Spear phishing is tailored to one person and often barely stands out technically.
Without the right tool, all that is left is a mail to everyone: "Please do not open." By the time it is read, someone has clicked.
Step 1: Report with one click
An add-on for the mail client adds a "Report phishing" button. One click forwards the open message to an internal reporting address. The gateway checks links, sender and attachments.
The reporter then gets a plain-language reply: malicious, suspicious or harmless. That matters more than it sounds. People who never hear back eventually stop reporting. The add-on only reads the open message and sends no telemetry.
Step 2: Pull the message out of all mailboxes
Once a message is confirmed as dangerous, the gateway finds it in all mailboxes and moves it to quarantine. This is called zero-hour auto purge. It works no matter who reported the message or how it was spotted, for example through a late sandbox finding.
If you want, this happens automatically: when the analysis rates a reported message as malicious, the gateway removes it from all mailboxes itself. This automatic cleanup is off by default. An admin switches it on deliberately once they trust the results.
Step 3: Check links again at the time of click
In case someone was faster than the recall, there is time-of-click protection. The gateway rewrites links in inbound mail. When someone clicks, it checks the address again. Suspicious pages open in an isolated browser, which records a screenshot and every redirect.
This also protects against pages that only turn malicious after delivery. Link rewriting is off by default and can be switched on where you need it.
Warn when a message is not clear-cut
Not every suspicious message has to go straight to quarantine. If it is delivered, the gateway can place a visible warning above the text, optionally with a link to report it. Signed or encrypted messages stay unchanged.
Working together with training
Technology and attention complement each other. People who practice regularly spot phishing faster and also report it. When someone reports a training message from the phishing simulator, the gateway recognizes it and thanks them for the report. The report counts as a success without setting off a real alert.
Roll it out step by step
Warning banners, link rewriting and automatic cleanup are off by default. That is on purpose. Start with the report button and manual recall. Then add warning banners and time-of-click protection. Automatic cleanup comes last, once you have watched the results for a while.
Conclusion
No filter catches everything. A good gateway therefore keeps the way back short: report with one click, a reply to the reporter, recall from all mailboxes and a check at the time of click. Read more about each feature on the phishing protection page. The glossary entry on the secure email gateway explains the basics.