From the moment mail arrives to the audit record left behind — scanning, policy, delivery and evidence, in one place.
Engines run in parallel on the full message, not on a sample, so no single signal decides a verdict on its own.
ClamAV plus signature feeds on every attachment, with archives unpacked and inspected rather than skipped.
Rspamd scoring combined with content and intent analysis, so a clean-looking payment request is still caught.
Links are checked against reputation feeds and can be rewritten so a click is evaluated at the moment it happens.
SPF, DKIM, DMARC and ARC are verified on arrival, and the result is recorded in the message trace.
Display-name and lookalike-domain checks against your own directory, which is where BEC usually starts.
Pattern and dictionary matching on outbound mail, so regulated data does not leave in an attachment.
A rule that cannot be tested is a rule nobody dares change, so every policy can be validated before it acts on live mail.
Conditions on sender, recipient, content, verdict and authentication, with actions from tag to reject.
Run a draft rule against recent traffic and see exactly which messages it would have changed.
Every policy change is versioned with its author, so a bad rule is one rollback away.
Admin and end-user quarantine with digests, one-click release, and sender allow and block lists.
Delivery, retention and audit are part of the product rather than an add-on, because that is what an incident actually needs.
Every engine result, the policy that matched, and per-recipient delivery status for each message.
Searchable retention with export, so a legal hold does not require reading mail server logs.
Every administrative action is recorded with actor, tenant and before-and-after state.
Scheduled reports, DMARC aggregate ingestion and a sending-source inventory for the enforcement journey.
The same platform, pointed at whichever problem you are actually being measured on.
Payment fraud and supplier impersonation pass SPF and DKIM cleanly. Intent analysis and lookalike-domain defense are what catch them.
Keep the mailboxes you have. Add scanning in front of them, and get the queue, spool and delivery visibility you never had.
Tenants are isolated by design, and branding, policy and reporting are all per tenant — so the platform can be sold as your own.
Retention, archive search and a tamper-evident audit trail mean the answer to "what happened to this message" is one query.