Vector 01 · Message

Catch the message before interaction.

Message reads every inbound and internal message the way an analyst would: what is being asked, who is really asking, and whether that ask fits the relationship. It catches spear phishing, business email compromise and QR-code lures without a signature, scored before interaction.

Orvander Holdings/Findings/#4821

AUG 24 - AUG 31 · 2026

Findings#4821

Quarantined Mark safeReleaseBlock

ThreatMessageAUG 31 · 09:41 CEST · detected in 187ms

Re: Q2 invoice, payment update

Envelope

FromAcme Finance <billing@acme-finance-eu.com>

Reply-tobilling@acme-finance-eu.com

PNJOLC+2

5 recipients · finance@orvander-holdings.com

Return-pathbounce@mail-03.acme-finance-eu.com

Message-ID<9f2c41ab-7d10@acme-finance-eu.com>

SummaryWhere this sitsPath

01mail-03.acme-finance-eu.com · 91.198.x.x · Moscow, RU09:41:02

02relay.smtp-forward.net · 185.220.x.x · Bucharest, RO09:41:04

03mx1.eu-west.protection.outlook.com · 104.47.x.x · Dublin, IE09:41:05

04orvander-holdings.mail.protection.outlook.com · Stockholm, SE09:41:05

Sender history RECIPIENTORG1W1M6M

First seen Aug 27

Inbound 15Outbound 0

Timeline

AUG 3109:41Received by Microsoft 365

09:41Scanned: 6 signals matched

09:41Quarantined before interaction

09:42Priya Nair notified

A quarantined BEC attempt, with the route it took from the sender’s infrastructure to the tenant.

41%of social-engineering breaches involve a channel other than emailVerizon DBIR, 2026

$123kaverage loss per reported business email compromiseFBI IC3 Internet Crime Report, 2025

1.4%median click rate in phishing simulations, the floor training cannot get pastVerizon DBIR, 2026

What it evaluates

Intent and language

Payment redirects, credential prompts, requests for secrecy and artificial deadlines, not keyword lists.

Sender identity and infrastructure

Display-name mismatches, newly registered and lookalike domains, SPF, DKIM and DMARC posture.

Relationship and thread context

Reply-chain reuse, injected replies, and suppliers that suddenly change banking details.

Links, attachments and QR codes

Destination analysis instead of reputation lookups alone.

Why the inbox is still the entry point

Native filtering in Microsoft 365 and Google Workspace resolves the bulk of unwanted mail. What remains is the targeted fraction: written for one recipient, sent from infrastructure too new to be on a blocklist, often with no link or attachment at all. Generative AI made that fraction cheap to produce at volume.

AI scoring on every inbound: header signals, behavioral history, content intent
Block before interaction or tag inline in the inbox
Same engine across email, Slack, and Teams
Vendor-compromise and thread-hijack detection

Reads with

No vector works alone.

LIVE

Vector 02 · App

Every app, AI tool and OAuth grant in your tenant, with scope-level risk per user. Risky grants revoked via the Workspace and 365 admin SDKs.

Q4 2026

Vector 03 · Identity

Dark-web credential monitoring, leak meta-analysis, identity exposure and domain-registration alerts. GA Q4 2026.

Q4 2026

Vector 04 · Behavioral

Per-user behavioral baselines. Anomaly scoring across data movement, access patterns, off-hours sessions.

See it on your own signals.

Free for one account. Four minutes to connect Google Workspace or Microsoft 365.

Try now →