Catch phishing before anyone clicks
A mail from "the boss" asking for an urgent transfer. An invoice from a domain that looks almost like your bank. The phishing protection in the Mail Security Gateway spots these tricks. It warns your staff and pulls dangerous mail back, even after delivery.
Request a demoHow the gateway exposes fake senders
Phishing works by deception. The sender looks familiar, but is not. So the gateway checks every inbound mail for several kinds ofspoofing.
Lookalike domains
Attackers swap letters. A Cyrillic "а" looks just like a Latin "a". The gateway spots such characters, punycode addresses and typo domains like "paypai". It compares them with domains you trust. It learns that list from your own mail traffic of the last 90 days.
Fake display names and CEO fraud
Often only the shown name is right. It says "Hans Müller", but the address is a free mail account. The gateway flags a display name that claims to be a protected person, a known brand or your own domain. This is the typical trick behind business email compromise (BEC), which means fraud with fake business mail.
Unusual sender behaviour
The gateway learns how known senders behave. Does a long-time partner suddenly change their display name? Or does their DMARC check fail all of a sudden? Then the behaviour analysis raises a flag. It is off by default. The gateway also spots DKIM replay: a properly signed mail is sent again along a foreign path.
QR code phishing (quishing)
Some phishing mails hide the link in a QR code. The gateway reads QR codes in image attachments and checks the addresses like any other link. Text recognition (OCR) also reads text that is sent as an image.
AI review of the content
Some fraud mails have no link and no attachment. A language model helps here. It reads the text and spots transfer requests, gift card scams or fake app consent requests. It rates the same campaign only once. If it later rates a delivered mail as dangerous, the gateway can pull it back.
There is also a check right inside the mail flow. You switch it on separately. It only runs on mail with suspicious signals, not on clean mail. The model can run on your own GPU server. Read more about the idea in our glossary entry on AI phishing detection.
Warn, report, recall
Warning banner with report link
Not every suspicious mail needs to go to quarantine. If it is delivered, the gateway puts a visible warning above the text. If you like, the warning holds a link to report the mail. Signed or encrypted mail stays unchanged. The banner is off by default.
Report phishing with an add-on
An add-on for the mail client adds a "Report phishing" button. One click forwards the open mail to an internal report address. The gateway checks links, sender and attachments. Then the reporter gets a reply in plain language: malicious, suspicious or harmless. Training mails from aphishing simulationare recognised as such. The add-on only reads the open mail and sends no telemetry.
Recall of delivered mail
Sometimes an attack only shows hours later. Then the gateway pulls the mail out of every mailbox. If you like, it also checks links again at the moment of the click. An isolated browser opens suspicious pages and takes a screenshot. Link rewriting is off by default.
Questions about phishing protection
- Does the phishing protection catch CEO fraud without a link or attachment?
- Yes, in many cases. The gateway checks the display name against protected people such as your managing director or CFO. If a language model is connected, it also reads the text, for example an urgent request for a wire transfer or gift cards.
- What happens to a phishing mail that is already in the inbox?
- The gateway finds it in every mailbox and moves it to quarantine. This is called zero-hour auto purge. After a confirmed user report, this can also happen automatically. That automation is off by default.
- Does the mail text have to leave our network for the AI check?
- No. You can run the language model on your own GPU server. The mail text then stays in your own network. You also switch on the inline check in the mail flow separately.
- Which features are on by default?
- Warning banners, link rewriting, behaviour analysis and automatic clean-up are off by default. This lets you add protection step by step and see its effect first.
Test phishing protection on your mail flow
We show you what the gateway finds in your mail and plan the first steps with you.
Request a demoHow we work with you
We want to work with you for the long run, not just deliver once. Our way of working has four steps. So you always know what comes next, who does what and what you get.
1. Free initial conversation
We learn where you stand and what you want. In 30 to 45 minutes we check if we are a good fit. We show you options and answer your questions. There is no obligation.
2. Current state review
We check where you stand today: tech, processes and rules. You get a list of strengths and gaps, sorted by urgency. Our offer is based on it.
3. Delivery with a dedicated lead
An experienced lead guides you through the project. You get clear goals, an open plan for time and cost, and a status every week. All results are written down and belong to you.
4. Running and reviewing
After the project we stay with you. We run systems for you, check them at set times and keep track of open tasks. When new threats or new rules come up, we get in touch.