From reported email to verdict, automatically
Imperum investigates reported phishing end to end. The Email-Phishing agent detonates attachments in a sandbox, checks URLs and brand spoofing with machine learning, validates SPF, DKIM and DMARC, and returns a verdict with the evidence attached.
Every reported email is opened Anything risky waits for your approval The verdict shows what was checked
A reported email is a job somebody has to do
Someone in finance forwards a message that looks wrong. Now an analyst has to read the headers, work out whether the sender is really who it says, open the link somewhere safe, look inside the attachment, find out who else got the same message and whether anyone clicked. That is careful work every time, and most of the time it ends with the email being harmless.
The Email-Phishing agent does that work on every reported message. It checks the sender, the links, the attachment and the delivery, then returns a verdict with the evidence behind it. When the answer is phishing, it clears up what your settings let it clear up and asks a person about the rest.
What the agent checks,
in plain words
Thirteen steps, the same for every reported email. Twelve of them read evidence and write down what they found. One asks the model to weigh it all up, and the last one acts on the answer.
-
01
Reads
Take in the email
The message is read as it was sent, headers and all, from the reporting button, a monitored mailbox or an email alert your SIEM raised. If the sender or the link is on your allowlist, the agent stops here and calls it legitimate.
-
02
Reads
Unwrap what was forwarded
People usually forward the suspicious message inside their own. The agent pulls the original back out and investigates the attacker's email, not the colleague who reported it. The report keeps both, so you can see who sent it in.
-
03
Reads
Plan the investigation
The agent decides which of the checks below this email actually needs. A message with no attachment does not get an attachment step.
-
04
Reads
Check the headers
SPF, DKIM and DMARC decide whether the sender is allowed to send as that domain. The agent re-runs the signature checks itself instead of believing the stamp already on the message, and reads the routing for signs the message was injected on the way.
-
05
Reads
Open up the attachments
PDFs, Office documents and images are taken apart: text pulled out, images read with OCR, macros and embedded links listed. A YARA scan runs over the file.
-
06
Reads
Follow the links
Every link is scored, then the risky ones are opened in the agent's own hardened browser, never on anyone's computer. It keeps the screenshot, the page and the network trace, so you can see the fake sign-in page instead of taking its word for it. Wrapped links are decoded first, so the real destination is what gets checked.
-
07
Reads
Detonate the attachment
The file is run in a sandbox and watched. The agent does not wait around for a slow sandbox: if the answer arrives after the verdict, the investigation reopens with the new evidence.
-
08
Looks up
Look into the sender
Who owns the domain, how old it is, what else it sends, whether the display name imitates one of your teams or a brand your people trust. Reputation lookups add what your threat intelligence sources know.
-
09
Looks up
Ask who else got it
Your SIEM and mail security answer: how many mailboxes received the message, whether anyone clicked, whether anything ran on their machine afterwards, whether a new inbox rule appeared. Sibling reports of the same campaign are grouped together.
-
10
Looks up
Bring in what you already know
Past phishing cases from your own environment, your analysts' earlier verdicts and the graph around the sender and the recipients are retrieved as context for the decision.
-
11
Decides
Decide
The model weighs the evidence and returns one of five verdicts with a confidence score, the kind of attack, the techniques used and a written summary. The Imperum Phishing Model scores the whole message alongside it, trained on your analysts' own confirmations.
-
12
Acts
Act on the verdict
Copies are moved to junk, the sender and the URL are blocked, the file hash goes to your endpoint tool, a malicious inbox rule is removed, an OAuth grant is revoked. Everything above the risk level you set waits for a person to approve it.
-
13
Acts
Write it all down
A case opens in Casebook with the report attached: what was checked, what was found, what was done and what is still waiting. The person who reported the email gets an answer.
Five verdicts, and what
happens after each
Every reported email ends in one of five states. Only the first two lead to any action on your estate.
A real attack, and the copies come out
The evidence is clear enough to act. The agent removes what it is allowed to remove, opens a case with the full report, and holds anything above your risk level for approval.
- Move copies to junk
- Block sender
- Block the URL
- Send the hash to your endpoint tool
- Remove a malicious inbox rule
Wrong, but not provably an attack
Something did not check out and the evidence stops short. A case opens with everything the agent gathered, and an analyst makes the call with the work already done.
- Open a case
- Hold the response actions for approval
A real email, reported by a careful person
Nothing is touched. The reporter is told the message is fine, and the email is recorded as a legitimate sample so the next one like it is recognized faster.
- No action on the estate
- Tell the reporter
Junk, but nobody is being attacked
Bulk nuisance mail. The agent stops before the response step, and the report says why. A case is still filed if you want spam tracked.
- No action on the estate
- Tell the reporter
A newsletter somebody did not know
Real sender, real business, unwanted email. It ends the same way as spam, and your reporters learn where the line is without anyone having to answer them by hand.
- No action on the estate
- Tell the reporter
You decide what it may do
without asking
The agent investigates on its own. What it may change afterwards is not its call.
One setting decides how much it may do alone
Pick how far the agent may go on its own and it stops there. Everything above that line lands in the approval queue with the evidence attached, so whoever approves it can see why it was asked. Start at the bottom and move up once you trust the verdicts.
The person who reported it hears back
Two emails, both optional and both yours to word: a receipt the moment the report arrives, and the answer when the investigation finishes. Nobody has to chase the SOC to find out what the email was.
Your own mail never gets investigated twice
Put your bulk sender, your security awareness platform or your own domains on the allowlist and the agent recognizes them at the door: a legitimate verdict, no lookups, no actions. Seven kinds of entry, exact, partial or pattern, and a test button that runs the real matching before you save.
It learns from your analysts
Confirm Phishing or Not Phishing on a case, and that email becomes a training sample for the Imperum Phishing Model in your own deployment. Correcting the agent teaches it more than agreeing with it.
See how Imperum learnsNothing reaches the model unredacted
Veil masks email addresses, names, hostnames and other identifiers before the model call and puts them back in the answer. Which categories are masked is your setting.
Questions about the Email-Phishing agent
1How does a suspicious email reach the agent?
Three ways, and you can use all of them. A Report Phishing button added to Outlook, a mailbox people forward to, or the email alerts your mail security already raises, which the agent picks up on its own schedule. Microsoft 365, Google Workspace, Exchange on site and plain IMAP are all supported.
2Does anything dangerous get opened on someone's computer?
No. Links open in the agent's own locked-down browser and attachments run in a sandbox, both away from your network. What comes back is a screenshot and a record of what the page and the file did.
3What can it change without a person?
Only what your risk level allows. Set it to none and every action queues for approval, including moving a copy to junk. Set it higher and the agent may junk copies, block the sender or remove a malicious inbox rule on its own. Whatever it does is written into the case.
4What does the analyst actually open?
A case in Casebook holding the verdict and its confidence, the sender and header findings, the sandbox results for the links and the file, who else received the message, the techniques involved and every action taken or waiting. Disagreeing takes one click, and the correction trains the model.
5Can it run on-premises or air-gapped?
Yes. Cloud, on site and air-gapped are all supported, with a model you host yourself where network policy requires it. The Imperum Phishing Model trains inside your own deployment on your own analysts' decisions.
Have any other questions?
Read the full question library
Send us one email your people reported
Bring a message from your own abuse mailbox. We will run it through the thirteen steps and read the verdict back to you with the evidence attached.