Takeover is caught at the sign-in, not at the invoice
Sign-in risk and mailbox changes are watched continuously, so the first sign of a compromised account is a detection and not a call from finance.
- SOC 2 Readiness
- 24/7 Security Monitoring
- Canadian-Based SOC
GuardsArm Platform · Detect
Email Security
Detect account takeover, mailbox exfiltration and phishing in Microsoft 365, and respond with approval.
Most business email compromise never touches an endpoint. It happens inside the mail tenant: a risky sign-in, a quiet forwarding rule, an app granted consent it should not have. Email Security watches for those signals and ties them to the same incidents and response engine as the rest of the platform.
- Microsoft 365
- Account takeover
- Approval-gated response
Email Security
Monitoring- Impossible-travel sign-inAccount takeover
- External forwarding rule createdExfiltration
- OAuth app granted consentApp access
- Malicious attachment deliveredPhishing
Every response action waits for approval before it runs.
What is at stake
A compromised mailbox is used to redirect a payment long before anyone thinks to look at its rules.
The quiet persistence gets found
Forwarding rules, delegation and consent grants are surfaced as their own categories, which is what stops an attacker keeping access after the password is reset.
Response has a record
Every action against the mail tenant is requested, approved and logged, so you can show who decided what and when.
Who carries this
Usually carried by the security lead with the Microsoft 365 administrator, and of direct interest to finance, because payment fraud is where mail compromise becomes a loss.
The problem
The attack that never touches a machine you manage
Business email compromise rarely involves malware. Someone signs in with a stolen password or a consented app, reads quietly for a while, then adds a rule that forwards invoices to an outside address or hides replies from the real owner. Every step uses a feature the mail platform provides on purpose.
Endpoint tooling does not see any of it, and the mail platform records it as ordinary configuration. What makes it visible is reading the sign-in, audit and mailbox data together and recognising the sequence: an unusual sign-in, then a rule, then a consent grant.
Email Security does that reading. It groups the signals the way an investigator thinks about them, by takeover, by exfiltration setup, by phishing and by app access, and it lets you act on the tenant with an approval step in between.
A forwarding rule is the cheapest persistence an attacker can buy, and nobody looks for it.
Capabilities
What Email Security detects and does
Account takeover signals
Impossible-travel sign-ins, password spray, sign-in brute force, risky sign-ins and identity risk detections, with the source addresses behind them ranked so a campaign is visible as a campaign.
Mailbox exfiltration setup
External mail forwarding, new inbox rules, mailbox delegation, external file sharing and mass mailbox deletion. These are the changes an intruder makes after getting in, and they are the ones a user almost never notices.
Phishing and malicious attachments
Suspected phishing emails and malicious attachments delivered to mailboxes are raised as detections with severity, the affected mailbox and the mapped technique.
App and consent abuse
OAuth app consent, credentials added to an application and illicit app access. Consent grants give persistent access to mail that survives a password reset, so they are tracked as their own category.
Investigate by mailbox
Pick a mailbox and see every email threat against it, its timeline and the response actions available, in one view. Multi-step mail attacks open incidents that are tracked through to response.
Approval-gated response and policy
Remediation in Microsoft 365 is requested, approved and then executed, with a full record of who did what. Block lists, allow lists and detection sensitivity are managed in the same place.
How it fits the platform
Email detections are ordinary findings on the platform severity scale, so a risky sign-in, the forwarding rule created an hour later and the endpoint activity that follows can be read as one incident instead of three tools.
How it works
From a risky sign-in to a remediated mailbox
How a mail attack moves through the area.
Connect the tenant
Microsoft 365 is connected from the console. Connector health on the Policy screen shows which data sources are configured and reporting.
Detections are raised by category
Sign-in, mailbox, phishing and app detections arrive with a severity and a mapped technique, and appear both in their own tab and in All Threats.
Sequences become incidents
When signals add up to a multi-step attack, such as exfiltration setup following an impossible-travel sign-in, an incident is opened and tracked.
Investigate the mailbox
The analyst opens the affected mailbox and reads its threats and timeline together, instead of assembling them from separate searches.
Queue a response
Response actions are queued from the threat or from the Investigation tab. They do not run against the tenant until they are approved.
Approve, execute, record
Once approved, the action is executed against Microsoft 365 and the request, approval and result stay on the Response screen as the record.
Questions
Common questions
Is this a secure email gateway?
No. Email Security is a detection and response layer for the mail tenant. It reads sign-in, audit and mailbox data from Microsoft 365 through connectors and raises detections on account takeover, mailbox exfiltration setup, phishing and app consent abuse. It works alongside the filtering your mail platform or gateway already does.
Do response actions run automatically against our tenant?
No. Email response actions are queued and require approval before they run. The Response screen records who requested each action, who approved it and the result.
Can we tune when detections fire?
Yes. Detection sensitivity, block lists and allow lists are managed from the Policy screen.
Works with
The modules next to this one
Every module runs in the same self-hosted stack and shares the same telemetry, severity model and response engine.
ITDR — Identity Threat Detection & Response
Detect identity-based attacks across your directories and cloud identities.
ExploreCloud & SaaS Connectors
Bring cloud, identity and SaaS audit activity into the same detection pipeline as your endpoints.
ExploreSOAR — Automation & Active Response
Respond in seconds, with guardrails.
ExploreSee Email Security running on your own infrastructure
We will walk through the console, the deployment model and what it takes to stand it up in your environment.
24/7 SOC Monitoring Available