The one control surface that argues with a human.
Most intrusions open in a mailbox, and mail is the single place where the attack is aimed at a person's judgment rather than at a machine's configuration. A well-built invoice fraud carries no malware whatsoever. There is nothing to scan. There is only a message that looks precisely like the supplier your accounts team paid last month.
Which is why this family has two halves, sold separately and working best together: a control that inspects and removes, and a program that trains the person the message is trying to talk round.
Ironscales works inside the mailbox, not only at the door.
A classic gateway makes one decision, once, on the way in. Everything it waved through becomes somebody else's problem permanently. Ironscales connects to the mail platform itself, and that changes what remains possible after delivery.
- Models trained per mailbox. Detection is built at the level of the individual recipient: who normally writes to this person, from what infrastructure, in what register, about which subjects. Impersonation and business email compromise surface as deviations from that particular relationship, which is the only workable way to catch a payload-free message claiming to come from your own chief executive.
- Removal after delivery. Once a message is convicted it is withdrawn from every mailbox that received it, including the ones already opened. In a live phishing run the number that matters is the gap between delivered and gone.
- Banners where the judgment happens. Warning tags appear on the message itself, at the moment somebody is deciding, rather than in a report read a week later.
- User reports improve the model. Somebody flagging a suspicious message with the alert button is not merely filing a ticket; that signal sharpens detection across the whole tenant. Training and filtering are one system here, not two purchases.
Attachments are detonated in a sandbox, and links are assessed both on arrival and again at the moment somebody clicks, since an attacker can leave a URL harmless until after it has cleared inspection.
Two lines, and how to pick between them
The combined line is the whole apparatus: filtering, impersonation and payload defense, outbound inspection, message withdrawal, warning tags, and the awareness program running alongside. Counted per mailbox. For most organizations this is the right answer and the only decision needed.
The training-only line exists for a narrower case: filtering you are already contractually committed to, or a mail platform a parent company mandates, where what is genuinely absent is continuous phishing simulation and a training program with reporting somebody will read. Counted per user.
Buying both against the same person means paying twice for the training half. If you are not sure which applies to you, ask and we will say plainly.
The lines in this family
Two lines / prices fetched liveEmail Security with Training
per mailbox| Filtering | Anti-spam, anti-virus, and custom content filtering |
|---|---|
| Impersonation | Imposter email protection with advanced BEC detection |
| Links | URL defense and predictive URL defense |
| Attachments | Attachment defense reputation and sandboxing |
| Post-delivery | One-click message pull from every mailbox that took it |
| Outbound | Filtering applied to mail leaving your tenant |
| User-facing | Email warning tags shown at the point of decision |
| Training | The whole awareness program in the line below, included |
| Counted by | One mailbox / monthly |
The complete line. Count shared mailboxes too, wherever they take mail from outside.
Awareness Training
per user| Simulation | Unlimited phishing security tests |
|---|---|
| Campaigns | Automated training campaigns plus security hints and tips |
| Reporting button | Phish alert button with phishing reply tracking |
| Directory | Active Directory integration for enrolment |
| Measurement | Industry benchmarking and reporting |
| Exposure | Monthly email exposure check and social engineering indicators |
| Counted by | One user / monthly |
The training program by itself, for estates whose filtering is already committed elsewhere.
What we will not claim about email defense
No filter catches everything. Whatever figure a vendor quotes for catch rate was measured against their own corpus, and the message that will hurt you is the one written specifically for your finance manager. This family is built to compress the interval between arrival and withdrawal precisely because interception is imperfect.
Training lowers click rates. It does not end them, and a program sold on the promise that it will is a program quietly abandoned after the first real incident. Assume the click, and make sure something is watching the endpoint underneath it, which is Managed detection.
None of this retains your mail. Pulling a hostile message and keeping a copy of a legitimate one are separate products; retention lives in Backup and continuity. And we can only defend mailboxes in tenants you have actually told us about.
Heads up: card statements show FORTIFY 24X7 - CyberDefense is a Fortify 24x7 brand, and your subscription is billed by Fortify 24x7.