Executive (CEO) fraud
Seen A “director” asks for an urgent, confidential wire.
Caught First-ever payment order from that account, unproven origin, engineered urgency.
Enterprise bench · 7/7 attacks · 0 false alarmsEssentialStandard
Detection is identical across plans — you always see the threat from Essential. Higher plans add automation, outbound protection and the account-takeover signal.
“Flag” = detected and labelled in the mailbox. “Act” = quarantine, alerts, API. “Included” = the capability ships with that plan.
| Use-case family | Essential | Standard | Enterprise | Enterprise Premium |
|---|---|---|---|---|
| Money fraud (executive · supplier · bank-change · payroll) | Flag | Act | Act | Act |
| Credential theft & impersonation (phishing · brand · QR) | Flag | Act | Act | Act |
| Dangerous attachments & links | Flag | Act | Act | Act |
| Data leaving the company (outbound DLP) | — | — | Included | Included |
| Account takeover — sign-in signal & correlation * | — | — | — | Included |
* The fraudulent email sent from a hijacked account is already caught by the rows above (from Essential). Premium adds the login signal that confirms the takeover and lets you cut the session.
Every plan detects the same threats. Plans differ in what happens next: automation, outbound protection, and the account-takeover signal.
| Capability | Essential 2.50 € | Standard 4.00 € | Enterprise 5.00 € | Enterprise Premium 12.00 € |
|---|---|---|---|---|
| Detection — the same for everyone | ||||
| Threat detection & mailbox labelling | ✓ | ✓ | ✓ | ✓ |
| Phishing · wire fraud · brand · QR · attachments | ✓ | ✓ | ✓ | ✓ |
| Attachment analysis (PDF/Office/OCR/QR/archives) | ✓ | ✓ | ✓ | ✓ |
| Trend reports (30 / 90 days) | ✓ | ✓ | ✓ | ✓ |
| Region of your choice — sovereignty (same price everywhere) | ✓ | ✓ | ✓ | ✓ |
| Automation — from Standard | ||||
| Fraud set aside (quarantine) | — | ✓ | ✓ | ✓ |
| Assisted & active modes (human or automatic action) | — | ✓ | ✓ | ✓ |
| Teams alerts | — | ✓ | ✓ | ✓ |
| Feedback loop, trusted domains | — | ✓ | ✓ | ✓ |
| API keys (read-only, revocable) | — | ✓ | ✓ | ✓ |
| Enterprise — from €5 | ||||
| Outbound data-leak protection (DLP) | — | — | ✓ | ✓ |
| Dedicated instance / region | — | — | ✓ | ✓ |
| Measured SLA (availability & verdict time) | — | — | ✓ | ✓ |
| Decision Center connector | — | — | ✓ | ✓ |
| Enterprise Premium — from €12 | ||||
| Account-takeover detection (sign-in + correlation) | — | — | — | ✓ |
| Session revoke / password reset (reversible) | — | — | — | ✓ |
Prices excl. tax, per mailbox per month (annual). Sovereignty — the region of your choice — is included in every plan, at the same price.
The costliest attacks carry no malware — they carry a convincing request to move money.
Seen A “director” asks for an urgent, confidential wire.
Caught First-ever payment order from that account, unproven origin, engineered urgency.
Enterprise bench · 7/7 attacks · 0 false alarmsSeen The same invoice, from a domain one letter off.
Caught Domain-distance to a known correspondent + bank details → human review.
Invoice bench · 20/20 (model alone missed ⅔)Seen An invoice from a real supplier, “new account”.
Caught Supplier account memory + a validated IBAN never seen for them.
Invoice bench · 12/12 fraud · 20/20 legit sparedSeen “Within 24 hours or the deal is off.”
Caught The deadline is computed in code (digits and words) and lowers the bar — only when another signal already spoke.
Deadline bench · +3 frauds quarantined, 0 false alarmsBefore the fraud comes the login. Most breaches start with a stolen password or session.
Seen A “security alert” with a button to click.
Caught The AI reads what the recipient actually sees (hidden text defeated) and follows where the link leads.
Nazario corpus · 98.7% detection · 0 FP on 1,400 legitSeen A perfect Microsoft or bank notice — the name even reads right.
Caught Brand spoofing, authentication headers, and names masked with combining characters.
Mechanism proven on real spoofsSeen A QR code to “scan and sign in” — even inside a PDF image.
Caught The QR is decoded (scanned images too) and its destination judged like any link.
Attachment pipeline · measured on QR-in-PDFSeen An HTML “login page” attached, to open offline.
Caught The attached page is read — the password field and where it would send.
Attachment pipeline · HTML form + destinationMFA stopped password theft. So attackers steal live sessions and act from a real, trusted account.
Seen Nothing — a valid, already-authenticated user.
Caught New device + new network + a session that never re-authenticated (AiTM, infostealer, device-code).
Simulator · token replay 0 → 100% · 0 FP on 45 real sign-insSeen A real colleague, replying in a real thread, asks for a payment.
Caught The login anomaly + the message, correlated to the same account in the same hour.
Correlated detection 97.9% · mail alone 73%We open the attachment in an isolated service — no network, nothing kept — and judge what it actually contains.
Seen “invoice.pdf” that is really a program.
Caught The real file type is detected, not the name; a second extension (.tif.exe) is flagged.
Attachment pipeline · signature-based typeSeen A photographed or scanned invoice (PDF image, TIFF).
Caught OCR reads the scan; the IBAN inside the image is validated and checked against the supplier.
Fixed a TIFF blind spot · body 1.85 → 3.89 once readSeen A forwarded .eml/.msg attached, “please see below”.
Caught The attached message is opened — up to two levels deep, its own attachments too.
Measured · 0.45 → 3.1 once the nested mail is readSeen A .zip with the password in the email body.
Caught The trick itself is a signal; unreadable is “not analysed”, never “safe”.
Attachment pipeline · protected-archive handlingThe same engine, pointed at outbound mail. Analysed by AI, nothing kept — the honesty is the argument.
Seen A database leaves for a personal inbox, the day before someone quits.
Caught The mass of identities in one message; what separates a leak from work is mass, not intent.
0 leaks on 17,247 real outbound messages, 231 sendersSeen A .pst export, a large archive, a .csv to an external address.
Caught The outbound attachment’s format and content are read — even the text inside it.
Deterministic · reuses the bank-account validationA page that hides its limits isn’t credible. Here’s where we stop.
Detection is identical across plans; plans differ in automation, outbound protection and the account-takeover signal. Proof points come from real corpora (phishing, corporate mail) and from a simulator replaying 2025–2026 techniques against the live detection, with legitimate control sets. Where a claim rests on modeled attacks it is labelled “mechanism proven” and confirmed per customer. Detection reads metadata and message text in your chosen region and keeps no message content. Screens are illustrations.
In two minutes our AI re-reads your week and shows you the scams nobody had seen. 7 days free.
Start freeNot the administrator? Send the invitation to the right person