Email threat detection
Submit a raw message, an .eml file, or type it in by hand. Deterministic rules score the sender, content, links and attachments; an AI layer explains the verdict without ever touching the score.
Signals inspected on every message
Deterministic engine
Every indicator carries a weight and a confidence. Rules fire, contributions are summed, and the score maps to a risk band you control — no black boxes, no drifting verdicts.
Critical · Credential harvesting indicators detected
Workflow
Upload an .eml, paste raw headers and body, or fill in a manual form. Each path converges on the same parsed email record.
The parser extracts headers, URL positions, and attachment metadata — including SHA-256 — while storing no attachment contents.
Adjust rule weights, minimum confidence, and band boundaries from the admin console. Bands must increase monotonically; critical always ends at 100.
A large-language model summarises the findings in plain language. It is assistive only and never changes the deterministic score or classification.
Surfaces
Cards carry real product fragments — findings, links, attachments and headers — so a reviewer sees the whole case without leaving the page.
Risk distribution
Findings by category
Sender
Content
URL
Attachment
Triggered rules
Links found
Rendered as plain text, never clickable.
Detection history is filterable by risk level, classification, source and date. Audit logs record who did what, when, and from where — so every decision can be reconstructed.
100%
Deterministic scoring
0
Clickable links rendered
It takes one submission to see the difference between a score and an explanation.
Configure rules and bands once, then score every message against them.