Phishing protection for the attacks your filters were never built for

Phishing is a message that tricks someone into handing over credentials, money, access or data by pretending to come from someone they trust. Filters stop most of it by recognizing what has been seen before: known-bad senders, URLs, files and patterns. The messages that cause incidents are the ones that have not been seen before.

• Targeted: written for one recipient, referencing a real project, supplier or colleague.
• New infrastructure: sent from a domain registered days ago, with clean reputation and valid authentication.
• AI-written: fluent, correctly localized, and different every time, so there is no template to match.
• No payload: a request, not a link or file. Payload scanners have nothing to scan.
• Hidden destinations: a QR code in an image or PDF that the user scans with a phone, outside the corporate network.

Microsoft Defender and Google’s built-in protection are a good baseline for bulk attacks, and Sentaro is designed to run with them rather than replace them. What it adds is the behavioral layer for what those filters miss by design. Because it connects over API inside the tenant, it also sees internal and historical mail, which is where an attack spreads once an account is compromised.

Vord, Sentaro’s proprietary engine, deconstructs each message into anywhere from tens to well over a hundred signals, runs them through expert algorithms and, when called for, larger reasoning models, and returns one verdict with its reasoning attached. It weighs four groups of evidence:

• Intent and language: payment redirects, credential prompts, requests for secrecy and artificial deadlines, not keyword lists.
• Sender identity and infrastructure: display-name mismatches, newly registered and lookalike domains, SPF, DKIM and DMARC posture.
• Relationship and thread context: reply-chain reuse, injected replies, and suppliers that suddenly change banking details.
• Links, attachments and QR codes: destination analysis instead of reputation lookups alone. QR codes are decoded and their destinations evaluated like any URL.

Built for lean teams

Verdicts are automatic and remediation is a click. Alerts fire when a decision is needed, not for every blocked message. One API connection covers phishing, business email compromise and shadow IT discovery in the same platform, so there is no second tool to buy, deploy or maintain. Every verdict shows its reasoning in the console, so admins can audit decisions rather than trust a score.

No single control prevents phishing. These layers work together, and most of them cost nothing beyond what you already license.

• Turn on the native protections you already pay for: Microsoft’s preset Strict policy and Defender for Office 365 features, or Gmail’s advanced phishing and malware settings.
• Publish and enforce DMARC on your own domains, so nobody can send exact forgeries of your address.
• Use phishing-resistant MFA (security keys or passkeys) for admins, finance and executives.
• Add a behavioral layer for targeted and payload-free messages that filters are not built around.
• Govern OAuth apps: review which third-party apps hold access to mail and files, and block consent phishing.
• Give users one obvious way to report a suspicious message, and act on reports quickly.
• Keep payment controls outside email: callback verification on any change of bank details.

Sentaro is a detection layer. It does not replace your spam and malware filter, DMARC on your own domains, phishing-resistant MFA, or payment verification procedures. It is not a security awareness training or phishing-simulation product, and it cannot inspect a phone call, so vishing and deepfake calls are out of scope. Sentaro’s own terms state that it does not guarantee that all threats will be detected or prevented.