Email & CEO fraud
Detects executive impersonation and business-email compromise in a mailbox you connect read-only, and says so for every attachment it could not examine.
What people come here for
Email Security
Detects CEO fraud and impersonation and inspects attachments through read-only Gmail and Microsoft Graph connections, raising an event for every attachment it could not examine.
Full definition →Read against who you actually are
A message is read against your organization's own domains, its executives, its known vendors and their real bank details, for the patterns that mark business-email compromise: a look-alike domain, a diverging reply-to, changed payment details, urgency and secrecy language.
Full definition →Connected read-only
The Gmail and Microsoft Graph connections are read-only, so detection works from the messages arriving in the mailbox you connect.
Full definition →An attachment it could not open is an event
Every attachment that could not be examined is raised as an event rather than passed over in silence.
Full definition →Everything else in this surface
Each name opens its own one-line definition in the capability catalogue.
What this does not do
Detection raises a finding on a message; what to do about the sender or the payment stays with you, and the guide lists what this surface stops short of.
Everything this product does not do →