01 the business
Mortgage brokerage
85 staff, outsourced IT support
Staff are told to report anything suspicious, then hear nothing back, so they stop. Each report needs someone to check headers, links and attachments. Meanwhile the same email may sit in other inboxes.
02 before
The problem
Staff are told to report anything odd, then hear nothing back, so they stop reporting. Each report needs someone to check headers, links and attachments, which takes time a stretched IT person does not have. Meanwhile the same email may be sitting in other inboxes across the company.
- Reports go unanswered.
- Checks take time the IT provider bills for.
- Copies of a phishing email stay in other mailboxes.
03 the build
What the AI does
- Step 1: Picks up messages sent to the report mailbox or flagged with the report button in Outlook or Gmail.
- Step 2: Checks sender details, links and attachments against VirusTotal and your mail security logs.
- Step 3: Classifies the email as safe, spam or likely phishing and writes a short reason.
- Step 4: Searches Microsoft 365 or Google Workspace for the same message in other mailboxes and prepares a removal list.
- Step 5: Replies to the reporter with the verdict and a one-line tip, and opens a Jira ticket for anything serious.
paused: waiting for a person to approve
How it was put together
- Picked up reported messages from the report mailbox and button.
- Checked senders, links and attachments against threat intelligence and mail security logs.
- Classified each email with a short reason and searched for copies across mailboxes.
- Replied to the reporter with the verdict and a tip, and opened a ticket for anything serious.
04 human in the loop
Where a person stays in charge
Your IT lead or managed service provider approves before any message is pulled from staff inboxes or any sender is blocked. Likely credential theft goes straight to a person by phone or Teams.
- The IT lead approves before messages are pulled from inboxes or senders blocked.
- Likely credential theft goes to a person immediately by phone or Teams.
- Verdicts include reasons so people learn.
05 rollout
From kickoff to live in 3 weeks
- Week 1Connect the mail platform and security tools; agree response rules.
- Week 2Triage reports with the IT provider reviewing every verdict.
- Week 3Switch on replies to reporters and the removal workflow.
06 after
What changes
Every report gets checked and answered, so staff keep reporting. Dangerous emails come out of every inbox quickly, and your IT lead spends time only on the reports that matter.
Assume 80 reports a month and 12 minutes of IT time each to analyse and respond.
80 × 12 minutes = 16 hours a month of analysis, often billed by an outside provider.
What to measure
- Time from report to verdict.
- Reports per month, as a sign staff trust the process.
- Copies removed from other mailboxes.
- Credential-theft incidents.
07 evidence
What the research says
Business email compromise caused reported losses of about $2.77 billion across 21,442 complaints in 2024, out of $16.6 billion in total reported cybercrime losses.
FBI Internet Crime Complaint Center, 2024 Internet Crime Report (opens in a new tab) · 2025
Third-party involvement in breaches doubled to 30%.
Verizon, 2025 Data Breach Investigations Report (opens in a new tab) · 2025
The global average cost of a data breach reached $4.99 million, a record high.
IBM, Cost of a Data Breach Report (opens in a new tab) · 2026
08 lessons
Mistakes to avoid
- Silence. Thank every reporter.
- Auto-deleting. Removal needs approval.
- Treating all reports the same. Credential theft is urgent.
09 questions
Common questions
- Why does this matter for a small firm?
- Email fraud is costly. The FBI recorded about $2.77 billion in business email compromise losses in 2024, and IBM puts the global average cost of a breach at $4.99 million.
- Does it work with Google Workspace?
- Yes, as well as Microsoft 365 with Defender.