What is email security analysis? How it differs from a spam filter
A spam filter screens out unwanted bulk mail; security analysis instead checks whether a single incoming email really comes from where it claims to, whether it contains impersonation or a fake link, and records the reasoning.
Most people equate email security with the spam folder. Yet the most costly attacks are not bulk spam; they are a single email sent to one accounting employee, impersonating a supplier and requesting an IBAN change. A spam filter is not designed to catch that.
What does a spam filter do?
It filters out bulk-sent unwanted advertising and similar emails. What it mostly measures is whether the email is “bulk and unwanted”.
What does security analysis do?
- Sender verification: did the email come from a server permitted by the sender's domain?
- Spoofing: does the sender name or domain impersonate a familiar organisation?
- Fake link: is the displayed link the same as the address it actually goes to?
- Rationale: is it written out how much each finding affects the risk?
Why do the reasons matter?
An employee who only sees a "suspicious" label will either ignore it or treat every email as suspicious. The rationale helps the employee make the decision: "The sender could not be verified; the link goes to a different domain."
Security analysis in SmartMail
- For every email: The sender is verified; impersonation and fake links are scored separately.
- Score with rationale: Each finding is listed with the points it contributes.
- Quarantine: An email below the trust threshold does not reach the mailbox but is held in quarantine; the administrator sets the threshold.
