Security alerts — four proactive systems for what slips through.

IOC monitor — learn from false negatives

When a spam mail passes the filter, it needs to be caught next time. The IOC monitor turns that into a feedback loop:

• End users report a mail as spam — via the quarantine portal or a link in the mail header
• MailGuard extracts URLs and sender domains from the reported mail
• The indicators are stored as an IOC (indicator of compromise) — type url_host or sender_domain
• All future mail containing an active IOC (same URL, same sender domain) receives a score boost

Metrics such as total reported mails, reports in the last 30 days and active URL and sender IOCs show the effect at a glance. Every user report becomes protection for everyone.

Outbound guard — detect compromised accounts

A hijacked SMTP account suddenly sends mail en masse — and ruins your domain's delivery reputation. The outbound guard monitors send volume per sender account (SMTP-auth user) in sliding time windows. If an account exceeds its normal rhythm several times over, an alert fires instantly — with sender, time window, mail and recipient counts, sample recipients and the detecting cluster node.

The recommended response is built in: disable the account, reset the password, review sent mail and, if needed, request blacklist delisting.

Retroscan — re-check delivered mail after the fact

A URL that was clean at delivery can be classified as phishing hours later. Retroscan re-checks already-delivered mail against the current phishing feeds: a scheduler runs (configurable, nightly by default) over all mail delivered in the last N days and re-matches their URLs. Hits land in the retroscan hits table — so you learn about a threat that wasn't even known at the time of delivery.

System alerts

The fourth area bundles system-level alerts of the gateway itself. All four systems are reachable directly via tabs in the interface — including deep links from the dashboard.

Secure what slips through, too?

Feedback loop, account monitoring and retroactive re-checks — MailGuard responds proactively, not only after the damage.

See pricing