EyrieDefender turns reported and suspicious emails into rapid, organization-wide protection through AI analysis, human validation, campaign recognition, and automated remediation.
Email is ingested from user reports, APIs, or security integrations.
AI examines content, headers, attachments, links, context, and behavior.
Campaign patterns are identified across recipients, timing, infrastructure, and tactics.
Human experts review the findings and confirm the threat level.
Confirmed threats are removed, users notified, and workflows triggered.
Intent, language, sender behavior, attachments, links, and conversation context.
Files remain inside the customer-controlled environment; only a locally generated file hash may be checked for reputation.
Indicators are extracted, enriched, and validated against multiple sources.
Tenant-owned history and local indicators are correlated without exporting user data, messages, URLs, or files.
Experienced analysts confirm findings and reduce noise.
Find every matching email and remediate across all affected users.
EyrieDefender is a post-delivery inbox security platform. Your mail gateway keeps blocking the ninety-five percent. We handle the five percent that got through — the five percent that looks legitimate because it was engineered to. Three modules, one verdict pipeline, one workflow.
The user reports. The analyst adjudicates. The engine removes it from every mailbox that got a variant. All three steps live inside EyrieDefender — no cross-tool export, no queue handoff, no context loss between the person who spotted it and the code that cleaned it.
The Outlook add-in and Gmail add-on your users tap when a message looks wrong. Runs pre-report AI and signature checks in the client so the verdict is visible before Report is clicked. One click submits the envelope to the pipeline.
The dashboard your SOC opens for every reported case. Verdict rationale, campaign clustering, per-tenant IOC editor, audit-log viewer, and a dry-run purge preview that lets an analyst confirm blast radius before pulling the trigger.
Zero-hour Auto Purge. When an analyst confirms a verdict, ZAP fans out across every mailbox that received a variant of the same campaign and removes them in one pass — under sixty seconds on a five-thousand-mailbox tenant in our reference build.
Any of them can veto. A high-severity verdict from any one input escalates to the human review layer before ZAP ever fires. Below the machine layers sit experienced human analysts — founding engineers included — reviewing high-severity cases and feeding real incidents back into the rule library.
Two-tier LLM verdict — fast pre-screen and deep adjudication — plus embeddings-based campaign clustering.
Human analysts on every high-severity case. Founders on the incident bridge, not a tier-1 queue.
Thousands of human-readable detection rules, versioned in git, tunable per tenant.
Per-tenant indicator library. New IOCs retroactively rescan every mailbox that already got a match.
Local context enriches the case. Only a cryptographic file hash may cross the boundary for reputation lookup.
Each sub-page below is a deep-dive on one dimension of the platform — how it works, what it catches, and what it costs to operate.
Two-tier LLM verdict — a fast pre-screen and a deep adjudication — plus embeddings-based clustering that surfaces campaigns a hash-only stack would miss.
A tenant-specific IOC library, local historical correlation, and optional hash-only file reputation checks.
One hardened virtual machine on-prem with no mailbox cap, or a cloud-native tenant-isolated deployment. Same code path either way.
EyrieDefender Assessor — the case queue, verdict view, campaign clustering, and dry-run purge preview your SOC lives inside.
REST endpoints for verdicts, cases, purge triggers, and IOC library. OAuth2 client credentials. Scoped tenant keys. Webhook subscriptions for verdict events.
Verdicts only run on messages a user has reported. There is no ambient mailbox scanning at rest. The persistent-mailbox-access risk is not in the attack surface.
User data, messages, URLs, attachments, and files stay inside your environment. Only a cryptographic file hash may be used for reputation lookup.
A single hardened virtual machine deployment runs with no mailbox cap. Above one hundred mailboxes we do not steer you to a cloud shape.
AI analysis runs inside the controlled deployment boundary in every supported deployment shape; customer content is never sent to an external AI service.
No tier-1 queue. Founding engineers are on the incident bridge, verifiable during a paid pilot.
Watchguard verdict on your envelope shape, Assessor cockpit against a live case queue, and a ZAP purge in dry-run so you see the blast radius before the trigger.