Many cyber attacks on companies start with malicious emails. Relying on default security from cloud email providers can leave the company vulnerable to cyber attacks exploiting the weak point of human nature and a lack of thorough email protection.

Emails are one of the most efficient vectors attackers use because almost every company uses email, and usually, every employee receives many emails daily.

​

Phishing

Hackers use phishing to trick people into giving away sensitive information, such as passwords or credit card details, by posing as a trustworthy entity or person.​​ They also gather information about businesses to draft personalized and convincing messages that are more likely to succeed on a person or a group of users within a company.

Malware

Malware is any program or code designed to harm or exploit computer systems, including viruses, worms, Trojans, and other types of malicious software. Email is an ideal delivery mechanism for malware. Malware can be attached directly to an email or embedded in documents shared as attachments or via cloud-based storage. Once installed on a computer, malware may steal sensitive information or encrypt a user’s files.

Ransomware

This malware encrypts a victim's files or data and demands payment in exchange for the decryption key, often causing significant damage to businesses.

Spoofing

Hackers disguise themselves as someone's identity to gain unauthorized access to private files.

Guardz uses an API-based approach to email protection.

When integrated with Microsoft, a journaling rule is created, which directs sent and received emails from the tenant to Guardz. Based on this, we can scan the emails that were received as soon as they're received (outgoing emails will be ignored). The emails are saved for the purpose of scanning by multiple tools, and when processing is complete, they are deleted.

When integrated with Google, Guardz subscribes to the "events" and performs scans based on that.

When integrated with Google, we'll subscribe to the "events" and perform the scan based on that.

We utilize the following capabilities when mail has been delivered to a user inbox:

Leveraging AI threat detection improves the accuracy of risk identification and categorization. Suspicious emails are scanned to differentiate between spam and real threats such as phishing, scams, etc., and to add some context around why the email was flagged. Emails will be tagged with a threat type, and each detection will provide a reason. "Threats" and "Reasons" will be included in the following areas of the platform:

The email protection settings can be found in the Security Controls > Email Protection and can be changed based on the needs and preferences of the customer. Here, you can configure how emails are scanned and handled. These are the areas of the security control:

Here you can activate or deactivate Impersonation Detection.

Spam Detection Toggle: Under the "Email Protection Scan" section, you'll find a new "Spam Detection" option. You can now easily toggle spam detection on or off. Disabling it means that new issues won't be generated.

Emails that are categorize as spam will be treated according to the organization’s configuration in "Email Protection" security control. There is also an option to configure spam emails to be automatically moved to the spam folder.

Note: Issues created for emails categorized as spam will be under a different section in the Issues page.

Customizable Spam Handling: You can decide how to handle detected spam emails. Choose from:

Caution Banner and Quarantine:

Users will see a banner at the top of the email, warning them that the email contains suspicious content.

Quarantine - Emails will be removed from the inbox and sent to the "quarantine zone." Quarantined emails are permanently deleted after the retention period. Admins can adjust the retention period including several days before deletion.

To review quarantined emails by threat level in the platform navigate to "Detection and Response" then filter by the "Email Protection" security control, and switch the view to "Inbox."

The action that is taken for emails at each risk level can be adjusted in the Caution Banner and Quarantine settings.

These are the risk levels and action options for each (note that high risk emails require an action):

The quarantine function will detect suspicious emails and relocate them into the “quarantine zone.” Then, an alert email will be sent to the end user to allow them to review the email in the user portal and take action as needed:

Admins can manually add specific email addresses or domains to the Allow List to ensure that all emails from that sender/domain are marked as safe, with no banner or quarantine. Similarly, email addresses or domains can be added to the Block List, ensuring that all emails from that sender/domain are blocked.

Use Email File Type Filtering to block or unblock specific file types for each customer. This management capability is found in Security Controls > Email Protection > Block List. The block/unblock list for files can also be adjusted based on domain or address.

When viewing email issues, we recommend using the table view dropdown for better clarity:

Admins can filter email issues by:

Email-related issues will notify of a risky email, and the risk score will determine its severity. Remediations can be applied to specific emails or senders.