Abnormal Inbound Email Security
API-based email security for Microsoft 365 and Google Workspace using behavioural models.
Security Awareness
Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
Addresses 270 stories in our coverage in the last 90 days 7 products that provide it
What it is
Filtering of incoming email for phishing, malicious attachments and links, impersonation and business email compromise, with the ability to pull a malicious message back out of every inbox.
How to value it
Email is still the most common way in, and the FBI's yearly reports rank business email compromise among the costliest cybercrimes. Better filtering means fewer attacks for people to spot, and removing a message from every inbox at once limits the damage when one gets through.
Questions to ask a vendor
- 1How does it catch business email compromise that has no link or attachment?
- 2Can we remove a malicious message from all mailboxes at once?
- 3How does it work alongside the protection built into Microsoft 365 or Google Workspace?
- 4How easy is it for staff to report a suspicious message, and do they hear back?
For your risk register
- Risk
- Phishing and business email compromise lead to stolen credentials or fraudulent payments.
- Control
- Advanced email filtering with removal after delivery and easy reporting.
- Owner
- IT operations lead.
- Measure
- Phishing emails reaching inboxes per 1,000 users.
A starting point: set the owner and measure to fit your organisation.
Products that provide it
Listed alphabetically by vendor. A listing is not a recommendation: use the questions above to compare them, or tick up to 3 to see them side by side.
Harmony Email & Collaboration
Email and collaboration security for Microsoft 365 and Google Workspace.
Cloudflare Email Security
Email filtering for phishing and business email compromise.
Darktrace / EMAIL
Email security that flags messages deviating from normal communication patterns.
Microsoft Defender for Office 365
Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.
Mimecast Email Security
Email filtering, impersonation protection and continuity.
Proofpoint Core Email Protection
Email filtering for phishing, malware and business email compromise.
Recent stories it addresses
803 stories in total- 17 Oct 2026Israeli Ad Firm Doubled as Candiru’s Zero-Click Spyware Delivery Channel
Israeli ad firm Discover-Tech used for Candiru spyware zero-click attacks against Al Jazeera.
- 16 Oct 2026Fake Claude, ChatGPT Attacks Surge, Putting Developers at Risk
Fake AI tools like Claude and ChatGPT are being used in phishing attacks against enterprise employees.
- 16 Oct 2026UAT-11985 Uses Fake Event Invites to Target Taiwan Research Affiliates With Google AitM Phishing
APT campaign uses fake event invites to target Taiwan research affiliates with Google AitM phishing.
- 16 Oct 2026Forescout uncovers ROMULUS malware delivery platform behind ClickFix attacks
Forescout discovers new ROMULUS malware platform used in ClickFix attacks, linked to Vice Society.
- 16 Oct 2026Cyber Threat Actors Use a Variety of Techniques to Target Election and Campaign Officials
US election officials warned of sophisticated phishing and smishing attacks targeting 2026 midterms.
- 16 Oct 2026Microsoft Patches Two Dozen RCE Flaws in Office
Microsoft releases patches for over 30 vulnerabilities, including two dozen RCE flaws in Office.
- 15 Oct 2026Android gets AI defenses against messaging scams, fake calls
Google rolls out AI defenses on Android against scams, fake calls, and call forwarding abuse.
- 15 Oct 2026Silent Lynx Exploits WinRAR Flaw to Deploy Reverse Shell in CIS Government Attacks
Silent Lynx targets CIS governments using WinRAR flaw and custom reverse shells.
How we list vendors
- A product is listed because it provides the control. Nobody pays to be listed, and on story pages the examples rotate, so no vendor is always first.
- Vendor pages show both the vendor's own research and the incidents involving its products, from our own coverage. We do not leave either out.
- Our summaries are written by us, based on the vendors' own pages. Text in quotation marks or marked "in their own words" is the vendor's own, quoted from its website.
- Logos, product names and quoted text belong to the vendors and are shown to identify them.
- Something wrong? Use "Suggest a correction" on the vendor's page. A product we should look at? Email support@threatnoir.com.