The message does not attack a computer. It attacks a working relationship.
The pattern is dull and it works. A message arrives with your name in the sender field. It is short, slightly urgent, phrased the way you phrase things, and it refers to something real, because the tour dates, the venue, the filing and the release are all public. It asks for a payment to be released, an invoice to be redirected, a document to be sent, or a login to be confirmed.
The person reading it is not careless. They are busy, they are used to being asked for things at odd hours, and their entire professional value is measured by responsiveness. Being publicly known is what makes the impersonation cheap. Everything needed to write a convincing message about your week is already published somewhere.
What is filtered before anybody reads it.
Mail Defence is Ironscales, standing in front of the mailbox and applying a stack of checks. Spam and malware filtering is the floor here rather than the point:
- Imposter protection. The detection of messages constructed to look as though they came from a person the recipient trusts, including lookalike domains and altered display names, which is the specific mechanism used against households like yours.
- Advanced business compromise detection. Messages that carry no attachment and no link, only an instruction. Nothing to scan and nothing to sandbox, so they are judged on context, relationship and phrasing.
- Link inspection, including prediction. Addresses are examined when the message arrives, and again at the instant somebody clicks, because an address that was harmless on Tuesday is frequently weaponised on Thursday. Predictive analysis flags addresses that resemble a campaign already under way.
- Attachment inspection. Reputation first, then detonation in a sandbox, so a document behaves somewhere disposable before it behaves on a laptop.
- Message recall. A single click drags a delivered message back out of every mailbox it landed in. That is the control which earns its keep on the morning somebody works out what went to the whole team an hour ago.
- Outbound filtering and warning tags. Mail leaving the account is inspected too, and messages from outside the organisation are visibly marked, which is a small measure that quietly defeats a great many impersonations.
Teaching the reader, not scolding them.
Filtering takes out the majority. What remains is a matter for the reader, and this is bought per person because the people who need it are specific: whoever handles payments, whoever holds delegated mailbox access, whoever answers strangers for a living.
The programme runs unlimited simulated phishing tests and automated campaigns, adds a reporting button to the mail client so a suspicious message can be handed straight to us, and tracks what happens when somebody replies to a simulation rather than only when they click. It reports at the individual level, benchmarks against comparable organisations, and runs a monthly exposure check on the addresses associated with your domain.
Simulations are not sprung on a principal.
A simulated phishing campaign is a useful teaching instrument and a poor surprise. We agree the scope with you before anything is sent: which addresses are included, whether the principal is in scope at all, and who receives the results.
Most households run the programme across staff and leave the principal out, or include them with prior notice. Individual results go to the person you nominate and nowhere else. Nobody is named in a report circulated for entertainment.
| Built on | Ironscales, in front of the mailbox |
|---|---|
| Filtering | Spam and malware screening, with content rules you set |
| Imposter | Protection against display name and lookalike domain impersonation |
| Business compromise | Advanced detection of instruction only messages carrying no payload |
| Links | Inspection on arrival and at click, with predictive analysis of new addresses |
| Attachments | Reputation assessment and sandbox detonation |
| Recall | Single click withdrawal of a delivered message from wherever it landed |
| Outbound | Filtering of mail leaving the account |
| Marking | Warning tags on messages originating outside the organisation |
| Billed | Monthly, for each mailbox |
| Built on | The Ironscales awareness programme, alongside the same mail platform |
|---|---|
| Simulations | Unlimited phishing tests and automated training campaigns |
| Reporting button | A one click report control in the mail client |
| Reply tracking | Records replies to simulations, not only clicks |
| Directory | Integration with your directory for enrolment |
| Measurement | Per person reporting and benchmarking against comparable organisations |
| Monthly check | An exposure check on the addresses associated with your domain |
| Scope | Agreed with you in advance, including whether the principal participates |
| Billed | Monthly, for each person enrolled |
Where this family stops
Mail Defence protects the mailbox in transit. It is not a copy of the mail: keeping recoverable copies of Microsoft 365 or Google Workspace is in Copies held elsewhere, and the two are routinely bought together.
Training measures and improves how people respond to messages. It does not stop a credential that has already been given away from being used, which is why the detection tiers watch identity events as well as endpoints.