CEDX Mail Security · IT & Security
CEDX Mail Security scores every inbound message for phish, malware, spoof and BEC — and instead of a black-box verdict, it shows who is being impersonated, which campaign the message belongs to, and why.
The board brief writes itself in three lines on the Overview: 320 threats scored this week, 95 critical stopped before delivery, and the vendor bank-change wave is the live storyline.
Runs on demo data — the threats are a demo corpus, stated on the screen itself.
What it is
64 principals scored for BEC risk; the radar shows the top 12 by transparent signal weights. The finance lead sits at 96 — CFO, VIP, and vendor bank-change mail in her path. The shared AP mailbox scores 84 for the same reason.
28 spoof campaigns in the tenant, 15 active. The vendor bank-change wave is 48 messages across 4 mailboxes at blast 98; the lookalike-domain spoof is 31 more. Clustering is the point: one blocked mail is luck, a named campaign is defence.
The threats table shows from-address, subject, verdict, confidence and what happened: blocked, tagged, quarantined — or delivered, with the risk still attached. The lookalike sender domains are legible in the from column, character by character.
Product tour
Not a mockup and not a concept deck. This is what opens at /app/mail-security.
01 — Overview
The board brief on the Overview reads: block rate 66.3% with 320 threats scored this week, 95 critical stopped before delivery; the vendor bank-change wave spoof cluster is the live storyline. Underneath it, the numbers the sentences came from.
02 — BEC radar
Twelve cells, worst first: the CFO at 96, legal ops at 96, the finance shared mailbox at 94, vendor management at 80. Each cell says why — payment path, executive display-name match, direct-deposit authority — and links to the evidence.
03 — Spoof board
Tax-season W2 phish at 60 messages, MFA-fatigue helpdesk spoof at 64, a partner-portal clone carrying malware. Each campaign card shows pattern, blast score, message count and status — active, watch, contained.
04 — Threats
“Wire approval needed today, vendor ACH” — BEC, critical, confidence 94, quarantined. “Gift card request, team offsite” — blocked. The demo corpus is 320 threats and the screen says so; nothing here claims your mail.
Who runs it
Roles, not references. We have no named customers yet, so nobody in these photographs is quoted, credited or claimed as one.
Turns the live campaigns into the training people actually get — the vendor bank-change wave is this week's lesson because it is this week's attack.
active campaigns · 15
Works the quarantine and the delivered-risk tab, tunes the block rate, and owns the 11 high-risk principals' protections.
quarantine held · 109
Reads the BEC radar before payment runs — vendor bank-change requests now get verified against a named campaign, not a hunch.
BEC high risk · 11The shape of it
Every figure below is legible in the captures above. Nothing here is a projection of your mail — it is the state of the demo data.
How it runs
Every inbound message gets a verdict and a confidence — malware, phish, BEC, spoof — before it reaches a mailbox.
Related messages roll up into named campaigns with a blast score, so the second lookalike-domain mail is recognised as the same attack as the first.
The BEC radar ranks the people attackers impersonate — finance, executives, shared payment mailboxes — and the protections follow the risk.
Quarantine ages, delivered-risk is its own tab, and the board brief writes the week in three lines you can check against the numbers below it.
One record
A reported phish, a clicked link, a compromised principal — they are events in the same stream the rest of the estate keeps, not a separate console.
A phish report arrives in the event stream as its own action type, next to the auth and lateral-movement events it predicts.
CEDX AccessThe 11 high-risk principals are identities with grants — BEC risk times standing privilege is the number Access keeps visible.
CEDX EndpointThe attachment that did get clicked becomes an endpoint detection — mass file encryption has a verdict and a confidence there too.
CEDX ComplianceSecurity-awareness and phishing controls are rows in the controls library — the campaign log is the evidence.
Limits
Finding this out on the third call is worse for you than reading it here, and worse for us.
Start
Open it right now
Your domains, your principals
Mail Security with the rest of it
Questions
Yes. Every screenshot is a capture of the running build and you can open the same build at /app/mail-security. The threats are a demo corpus — the screen says so.
A scored view of the 64 principals most worth impersonating — executives, finance roles, shared payment mailboxes — by transparent signal weights: payment-path authority, VIP flag, executive display-name matches in inbound mail. Click a cell and the evidence opens.
One blocked phish is a blocked phish; 48 related messages across 4 mailboxes is a campaign with a name, a blast score and a status. Clustering turns individual verdicts into a board you can brief from — the Overview does exactly that in three lines.
It lands on the delivered-risk tab — 28 in the demo — with the verdict and confidence still attached, so nothing disappears into an inbox just because it was not blocked.
No certification has been issued. What we can evidence about hosting, encryption and tenant isolation is written up on the security page.
Live build, demo data, no card. Then ask who the top cell on your own BEC radar would be.