A Fortify 24x7 brand, looking after the computers, records and back office a small firm trades on.Sign inTalk to the board
CyberSec Managed
Position 03 / Mailbox line

The invoice was real. The account number printed on it was not.

Post is where most small firm losses actually start, and seldom in the dramatic manner people picture. It is a real supplier, on a real thread, with changed bank details partway down. Two circuits work here: one down inside the mailbox, one on the reading habits of the people in front of it.

IronscalesInside your own tenantNot a gateway
2 circuits wired at this position
On the board2
EquipmentIronscales
Charged byMailbox or user
ConnectionAPI into your tenant

Why down in the mailbox rather than out in front of it

A gateway stands between the internet and your post and inspects what crosses. That is a sensible thing to own, but it never lays eyes on a message sent from a colleague's account that fell over last week, because such a message never crosses the boundary at all. Ironscales sits at mailbox level and connects over API. It is no kind of gateway. It plugs into the Microsoft or Google tenant already on your bill and examines post where it lands.

Sitting there also means a message judged bad after delivery gets withdrawn from every mailbox it landed in, the ones already opened included. No gateway can reach into a mailbox and do that. This is the practical difference, and it is why the distinction gets laboured on this page.

What rehearsals buy, and what they do not

Simulated phishing carries a poor name because it is so often used to catch staff out and then wave a percentage at a board meeting. That is not the purpose. The purpose is one small repeated habit: stop before acting on a message about money, and verify by some route other than the one the message arrived down.

Short lessons reach the individual who needed one, at the moment they needed it, rather than an annual seminar the whole firm attends and forgets by Thursday. That cuts the number of people who click. It does not take the number to zero, and any supplier claiming otherwise has never watched a busy team at half past four on a Friday.

The message that costs you money will look exactly like the twenty before it, because it came from the very same account.
Jacks on this position

Write ups and rates

Prices below arrive straight out of billing. Whatever gets patched in waits on the list while you read on.

Fortify-FES+SATWrite up

Mailbox Defense with Training

Ironscales, sitting in the mailbox instead of in front of it

Ironscales sits at mailbox level and connects over API. It is no kind of gateway. Working from inside the tenant already on your bill, it examines post that has arrived, which is the one vantage point that catches a message sent by a colleague whose account fell over last week.

  • Plugs in over API and examines post already sitting where people read it.
  • Impersonation and takeover detection, tuned to the way your own firm writes mail.
  • Anybody can flag a suspect message, and a confirmed one is pulled out of every mailbox.
Patched toIronscales, joined over API within your own tenant
Listens onPost that has arrived in the mailbox, not traffic passing a gateway
Line heldFlagged messages, and the outcome recorded for each
Answered byRemoval by software, with our operators on the awkward ones
Traced byOne mailbox, charged monthly
Readingper mailbox
payable in advance, monthlyQTY
Fortify-SATWrite up

Phishing Simulation and Training

Ironscales, running the rehearsals

Rehearsal messages that behave like the genuine article, aimed at your own staff. Whoever falls for one gets a short lesson afterwards. The purchase is a member of staff who hesitates over an invoice from a nearly right address.

  • Rehearsals go out quietly rather than announced, because an announced one proves nothing.
  • Short lessons go to the individual who needs one, not to the whole firm in a seminar.
  • A per person record, which is what an insurer or a bigger client will ask you to show.
Patched toIronscales
Listens onHow each individual answers a rehearsal message
Line heldA per person record of what went out and what came of it
Answered byA short lesson assigned by software after a miss
Traced byOne trained user, charged monthly
Readingper user
payable in advance, monthlyQTY
Plain limits

Calls we cannot take

This position earns its keep and it has edges. Set out below is the ground these circuits leave uncovered, plainly enough to plan around.

  • No gateway, and no pretending otherwise. What sits here works at mailbox level, over API, inside your tenant. Where the requirement is specifically a mail gateway ahead of delivery, this circuit does not answer it, and saying so at the outset is cheaper than saying so later.
  • A real account used by its real owner is not a threat to it. Where somebody with legitimate access chooses to send a file out of the building, mail security is not the control that intervenes. The data discovery position sits nearer to that problem.
  • Rehearsals cut clicks. They do not abolish them. An outcome in which no member of staff ever clicks anything again describes a firm with no members of staff.
  • Personal webmail lies outside the scope. This protects mailboxes in the tenant you connect. Somebody using a personal account on a work laptop is doing it somewhere we have no visibility.
  • Not an archive, and not a legal record. Retention and legal hold are separate disciplines. Keeping copies of a mailbox belongs to the copy and restore position.
NOTICE

Heads up: card statements show FORTIFY 24X7 - CyberSec Managed is a Fortify 24x7 brand, and your subscription is billed by Fortify 24x7.

Position 01Detection deskPosition 02Allowlist controlPosition 03Mailbox linePosition 04Device boardPosition 05Data discoveryPosition 06Copy and restore
Every circuit and rateSix positionsAccount portalOpen the rates