Platform
An inspection pipeline built for the post-delivery reality.
API-connected security sees every message the moment it lands. Vantmail is engineered around that window — to detect fast, act safely and show its work.
Detection spine
Four tiers. One explainable decision.
Tier 0 · Authentication
SPF, DKIM and DMARC results, sender alignment, reply-to mismatches and header evidence.
Tier 1 · URLs, files & QR
URL indicators, optical QR decoding, file signatures, document macros, PDF active content, HTML smuggling and archive inspection.
Tier 2 · Identity & BEC
VIP impersonation, lookalike domains, first-time sender indicators, payment requests and urgency-language scoring.
Tier 3 · Selective AI review
Ambiguous messages receive an additional language-model review. AI informs the evidence; deterministic signals and policies retain decision authority.
Lifecycle
From first message to lasting protection.
Discover
Mailboxes, users, VIPs and existing protection are inventoried at connect time.
Analyse
Connected inbound messages is fetched, normalised and scored through the detection spine.
Detect
Signals combine into a calibrated confidence score per threat category.
Investigate
Analysts see the full evidence chain, raw headers and a plain-language explanation.
Decide
Policy maps confidence to action — alert, banner, move to junk or quarantine.
Respond
Provider-specific quarantine and release operations are recorded in the audit trail.
Learn
User reports and analyst decisions support investigation and manual policy tuning.
Engineering principles
Designed for accountable security operations.
Event-driven and durable
Provider notifications are persisted before acknowledgement, deduplicated and reconciled against delta sync to support reliable processing.
Reversible by design
Quarantine and release use provider-specific actions. Analysts review outcomes through the console.
Tenant-isolated
Tenant-scoped access controls, encrypted provider credentials and protected platform administration.
Extended inspection
Reputation and sandbox integrations.
Vantmail includes integration hooks for file-hash reputation and CAPE sandbox analysis. These require configured services and deployment validation before activation. Static file inspection is available independently. Content Disarm and Reconstruction (CDR), outbound blocking and DLP are not part of the current platform.
Link intelligence
Knows a tracker from a trap.
Almost every legitimate newsletter and receipt shows one address and loads another through a click-tracker. Vantmail understands that difference — so real business mail stays clean while genuine deception is flagged.
Tracker-aware analysis
Recognises Microsoft Safe Links rewrites and mainstream email-service click-trackers, so routine marketing and transactional mail is not mistaken for deception.
Authentication-weighted
A displayed link that differs from its destination is weighed against the sender's cryptographic authentication — strong evidence from a stranger, context from a proven sender.
Real concealment still caught
Displayed domains that resolve to unrelated lookalikes, user-info tricks, punycode and embedded redirect chains are decoded offline and flagged with the evidence shown.
A clearer view of your email risk.
Explore Vantmail with your team. Discuss deployment, threat coverage and the controls your organisation needs.