Abnormal Inbound Email Security
API-based email security for Microsoft 365 and Google Workspace using behavioural models.
Security Awareness
Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
Addresses 315 stories in our coverage in the last 90 days 7 products that provide it
What it is
Filtering of incoming email for phishing, malicious attachments and links, impersonation and business email compromise, with the ability to pull a malicious message back out of every inbox.
How to value it
Email is still the most common way in, and the FBI's yearly reports rank business email compromise among the costliest cybercrimes. Better filtering means fewer attacks for people to spot, and removing a message from every inbox at once limits the damage when one gets through.
Questions to ask a vendor
- 1How does it catch business email compromise that has no link or attachment?
- 2Can we remove a malicious message from all mailboxes at once?
- 3How does it work alongside the protection built into Microsoft 365 or Google Workspace?
- 4How easy is it for staff to report a suspicious message, and do they hear back?
For your risk register
- Risk
- Phishing and business email compromise lead to stolen credentials or fraudulent payments.
- Control
- Advanced email filtering with removal after delivery and easy reporting.
- Owner
- IT operations lead.
- Measure
- Phishing emails reaching inboxes per 1,000 users.
A starting point: set the owner and measure to fit your organisation.
Products that provide it
Listed alphabetically by vendor. A listing is not a recommendation: use the questions above to compare them, or tick up to 3 to see them side by side.
Harmony Email & Collaboration
Email and collaboration security for Microsoft 365 and Google Workspace.
Cloudflare Email Security
Email filtering for phishing and business email compromise.
Darktrace / EMAIL
Email security that flags messages deviating from normal communication patterns.
Microsoft Defender for Office 365
Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.
Mimecast Email Security
Email filtering, impersonation protection and continuity.
Proofpoint Core Email Protection
Email filtering for phishing, malware and business email compromise.
Recent stories it addresses
923 stories in total- 13 Nov 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents
City of Osaka discloses breach affecting 1M email addresses via compromised third-party platform.
- 13 Nov 2026New TypoPrompting Attacks Turn Mistyped AI Website Addresses Into Malware Installation Traps
TypoPrompting attacks exploit mistyped AI website addresses to deliver malware and hijackers.
- 13 Nov 2026Hackers Use Fake Purchase Order Emails to Deliver XLoader Malware Through Malicious Word Documents
Hackers distribute XLoader malware via fake purchase order Word documents exploiting CVE-2017-11882.
- 13 Nov 2026How attackers turned a Teams meeting booking into a device code phishing trap
Attackers used a fake Teams scheduler to trick an employee into approving a device code sign-in.
- 13 Nov 2026Macfinger ClickFix campaign sends DownTheDRAIN infostealer for macOS, (Fri, Nov 13th)
Macfinger ClickFix campaign distributes DownTheDRAIN infostealer for macOS.
- 12 Nov 2026Fake Zillow pages use ClickFix NetSupport RAT to target apartment hunters
ClickFix campaign uses fake Zillow pages to install NetSupport RAT on Windows computers.
- 12 Nov 2026186 Fake AI Domains Redirect Users to ClickFix Lures, Browser Malware, and Search Hijackers
186 fake AI domains redirect users to malware, search hijackers, and click-lures.
- 12 Nov 2026Hijacked email accounts complicate investigations into European bomb hoaxes
Bomb threats sent to thousands of European schools originated from a compromised Taiwanese university email account.
How we list vendors
- A product is listed because it provides the control. Nobody pays to be listed, and on story pages the examples rotate, so no vendor is always first.
- Vendor pages show both the vendor's own research and the incidents involving its products, from our own coverage. We do not leave either out.
- Our summaries are written by us, based on the vendors' own pages. Text in quotation marks or marked "in their own words" is the vendor's own, quoted from its website.
- Logos, product names and quoted text belong to the vendors and are shown to identify them.
- Something wrong? Use "Suggest a correction" on the vendor's page. A product we should look at? Email support@threatnoir.com.