Mail is still where the authorization gets requested.
The mail that works against this industry is not the Nigerian prince. It is a reply inside a thread you started, from a counterparty domain that is genuinely theirs, because their side got compromised first and the operator is now reading the conversation and waiting for the moment settlement instructions come up.
Close behind it: a deadline framed as an allowlist or claim window, a portfolio company update sent to a fund with an attachment nobody questions, a payment detail change at an OTC desk arriving the day before a large transfer, and a support conversation that starts on mail and moves somewhere unlogged.
What the gateway actually does.
- Impersonation and business email compromise detection. Display name abuse, lookalike domains, and reply-to divergence, evaluated against how your organization normally corresponds.
- Link defense at click time. Links are rewritten and evaluated when they are opened, not only when the mail arrived, which is what catches a page weaponized after delivery.
- Attachment reputation and detonation. Unknown attachments are executed in a sandbox and judged on behavior rather than on a signature.
- One-click message pull. A message already delivered to every mailbox can be retracted from all of them at once. This is the control that matters most when the detection arrives twenty minutes late.
- Warning tags and outbound filtering. Unfamiliar senders are banner tagged in the client, and outbound mail is filtered too, which keeps a hijacked account from becoming your counterparty's incident.
Training that runs continuously.
An annual video changes nothing. Continuous simulation does, because the measurement is behavioral: who reports, who clicks, who submits credentials, and whether that improves. Campaigns run automatically, the reporting button sits in the mail client, replies to simulations are tracked, and results benchmark against comparable organizations.
The monthly check on address exposure is the underrated part. It tells you which of your addresses are publicly discoverable and appearing in breach corpora, which is precisely how a targeted thread hijack gets aimed at the right person on your desk.
Mail Filtering with Training
The full mail control set plus the training program, priced per mailbox.
- Spam and virus filtering, plus content rules you write yourself.
- Impersonation and business email compromise detection.
- Predictive link defense evaluated at click time.
- Attachment reputation checks and sandbox detonation.
- One-click pull of a message already delivered across the tenant.
- Outbound filtering and warning tags in the client.
| Coverage | Inbound and outbound mail on your mail platform |
|---|---|
| Impersonation | Display name, lookalike domain, and business email compromise detection |
| Links | Rewritten and evaluated at click time, including pages weaponized after delivery |
| Attachments | Reputation scoring plus sandbox detonation |
| Retraction | One-click message pull across every affected mailbox |
| Training | Included, matching the standalone training line |
| Priced by | Mailbox, monthly |
monthly rate, taken up front QTY
Phishing Simulation and Training
The training program on its own, for teams whose mail filtering is already handled elsewhere.
- Unlimited phishing simulations with automated campaign scheduling.
- A report button sitting in the mail client, and simulation replies tracked.
- Directory integration so the roster maintains itself.
- Industry benchmarking, and a monthly check on how exposed your addresses are.
| Simulations | Unlimited, automated campaigns |
|---|---|
| Reporting | Phish alert button plus reply tracking |
| Roster | Directory integration keeps enrollment current |
| Content | Short awareness material rather than annual long form |
| Measurement | Industry benchmarking and per user trend |
| Exposure | Monthly check on publicly discoverable addresses |
| Priced by | User, monthly |
monthly rate, taken up front QTY
Where this layer stops
A mail gateway sees mail. A very large share of what targets this industry never touches mail at all, and no filtering product on the market changes that.
- Direct messages on chat and social networks are not filtered here. Web filtering, execution control, and trained people are what carry that traffic.
- The training line on its own performs no filtering. It measures and improves behavior; it does not stop a message.
- Retraction removes a message from mailboxes you control. It cannot remove one already forwarded to a personal address.
- Nothing here inspects or intercepts what your people do inside a wallet or an exchange interface. That boundary is deliberate.