The attack arrives as an email.
Nearly every incident we have ever cleaned up started in an inbox — a fake invoice, a spoofed partner, a link that looked right. The gateway filters mail before it reaches people, because after is too late.
Training people to spot phish is useful. Making sure the phish never arrives is better.
The industry loves blaming the person who clicked, but a well-crafted lure beats a busy human often enough that the inbox cannot be the control. The gateway’s job is volume: strip the mechanical bulk — spoofed domains, poisoned attachments, credential-harvest links — so the rare hand-crafted attempt lands in front of a person who is not drowning.
Six lures, filtered upstream.
The catalogue is stable because it works. These six patterns account for nearly everything that would otherwise reach staff.
| The lure | What the gateway does | The residual risk |
|---|---|---|
| 01Fake invoice with new banking details | What the gateway doesImpersonation rules flag the reply-path mismatch and quarantine it | The residual riskA genuine compromised supplier — verify by phone, always |
| 02CEO display-name spoof | What the gateway doesExecutive names are protected; external mail wearing them is flagged or held | The residual riskA compromised real account — which MFA exists to prevent |
| 03Lookalike domain (yourco-inc.com) | What the gateway doesNewly-registered and cousin domains scored and blocked | The residual riskThe one registered months in advance — link rewriting catches the click |
| 04Credential-harvest link | What the gateway doesRewritten at delivery, checked again at click time — dead links die even after delivery | The residual riskA user who types their password anyway; conditional access limits the damage |
| 05Poisoned attachment | What the gateway doesDetonated in a sandbox first; macro documents from outside held by default | The residual riskGenuinely novel exploits — which is what EDR is for |
| 06Your domain spoofed at others | What the gateway doesDMARC at reject means mail pretending to be you bounces everywhere | The residual riskNone — this one is actually solvable |
The pattern in the residual column: no single layer finishes the job. The gateway thins the volume; EDR, MFA and a phone-verification habit catch what slips. The attacks it is thinning are described in the phishing and BEC patterns hitting Canadian SMBs, and the human half in training a team to spot them. Sectors that feel this most: law firms and non-profits.
The ones people actually ask.
If yours isn’t here, ask it directly — you’ll get an answer from an engineer, not a form letter.
It filters, and the baseline is genuinely decent. The gateway adds the layers that stop targeted attacks: executive impersonation rules, click-time link checking, attachment sandboxing, and enforcement of your own domain’s DMARC. Defence against a generic phish and defence against a crafted one are different products.
Occasionally, especially in the first tuning weeks — that is what the daily digest and one-click release are for. We tune rules per sender rather than loosening the whole filter, so false positives fall fast without opening holes.
It is the public policy that tells every mail server on earth to reject messages pretending to be from your domain. Published and enforced, it ends a whole category of fraud against your clients and suppliers — done once, it simply works.
No, and nobody honest will tell you otherwise — the residual case is a genuinely compromised supplier sending from their real account. Technology thins the odds dramatically; the phone-verification habit for changed banking details is what closes them.
Yes — part of the baseline stack in every managed engagement, alongside EDR, DNS filtering and firewall management.
Next
Filtered before the click.
Twenty minutes. Forward us nothing — just tell us the last phish that made it through, and we will tell you which rule would have held it.