Detonation of attachments, inspection of links, defence against impersonation, recall of a delivered message, and filtering underneath all of it, with recorded training for the person behind the mailbox.
Short lessons on a repeating cycle, invented payment lures, comparison against your sector, and a completion record naming each person, for firms whose gateway lives elsewhere.
The message that costs the most is the one that never looked wrong.
Crude phishing is a solved problem. A gateway removes it in volume and your staff never see the residue. What remains, and what this industry loses money to, is a short, correctly punctuated message from an address that is either genuine or one character away from genuine, referring accurately to a matter that is actually open.
It arrives at the right moment because the sender has been reading the thread. There is no attachment to detonate and no link to inspect. It asks a colleague to do the ordinary thing, and the control that would have caught it is not a product at all: it is somebody picking up the phone to a number they already had.
So this family has two halves, and buying only one is the common mistake. The gateway removes the volume so attention is not exhausted before the real one arrives. The training builds the habit that stops it, and produces the dated record that shows the habit was taught.
What the filtering half actually does.
Standing in front of the mailbox and built on Ironscales, the gateway line carries virus and spam screening, content rules you set, protection against imposters and lookalike senders, link defence including predictive rewriting, reputation scoring and sandbox detonation for attachments, filtering on the way out, and warning tags stuck to anything bearing the marks of an attempted business email compromise.
Two of those are worth naming, because they earn their keep after the event rather than before it. A single-click pull reaches into each mailbox a message landed in and withdraws it once somebody identifies it, shrinking a firm-wide exposure into a contained one. And business email compromise detection reads for the linguistic and relational signatures of payment redirection instead of hunting a malicious payload, since on this class of message there is no payload to find.
Recurring, short, and above all recorded.
Training in this catalog is not an annual video. It is unlimited simulated phishing, short recurring lessons, a report button that puts a suspicious message in front of somebody who can act on it, reply tracking on the simulations, directory integration so the roster maintains itself, industry benchmarking, a monthly exposure check on addresses that have appeared in breaches, and social engineering indicators attached to the simulations so a person can see what they missed.
The output is a per person record with dates on it. Who was tested, who reported, who clicked, what they were shown afterwards, and when. That record is the part the rule asks for, and it is worth more than a certificate of attendance for a session nobody can date.
Both lines are per person. The gateway line is priced per mailbox because that is what it protects; the standalone training line is priced per member of staff, which for most firms is the same number.
Which of the two lines your firm should buy.
- Mail Gateway with Staff Training is the whole family for one price per mailbox. Take it unless a gateway is already contracted elsewhere.
- Phishing Simulation and Awareness is for firms whose mail filtering sits with another provider, or inside a platform licence they cannot unbundle, but who have no training record to show.
Buying training alone and calling the program complete is the failure mode we see most, and it is worth saying so on the page that sells it. Attention is finite. A workforce trained to be suspicious of everything, then handed forty questionable messages a day, stops being suspicious of anything by Wednesday.
The element this family answers, and the gap it leaves
The rule requires a firm to implement policies and procedures ensuring that personnel are able to enact the information security program, and it names security awareness training that is updated to reflect risks identified by the risk assessment. The simulation and completion records produced here are the evidence that the training happened, to whom, and when.
Recall and warning tags feed the incident response element too. Where your written plan undertakes that a confirmed malicious message will be pulled out of each mailbox it reached, this is the mechanism that lets the undertaking mean something.
What no filtering product can do is decide whether a payment instruction is genuine. Verification of changed bank details through a channel other than the one that requested the change is a business process, it belongs in your written program, and it is the single control that most reliably prevents this loss.
| Platform | Ironscales, run for your firm by Fortify 24x7 |
|---|---|
| Gateway filtering | Virus and spam screening, content rules of your own, filtering on outbound mail |
| Link handling | URL defence and predictive URL defence on inbound messages |
| Attachment handling | Reputation scoring and sandbox detonation before delivery |
| Impersonation | Cover against imposters, detection tuned for business email compromise, and a warning tag stuck to the message |
| Containment | A single-click pull that reaches each mailbox a confirmed message landed in |
| Training content | Unlimited phishing simulations, recurring short lessons, social engineering indicators |
| Training operations | Automated campaigns, phish alert button, reply tracking, directory integration |
| Reporting | Completion and simulation results named to each person, comparison against your sector, and a monthly check for exposed addresses |
| Counted by | Each mailbox on the gateway line, each member of staff on the training line, monthly |
Where these lines stop
Filtering does not authenticate the sender's intent. A message from a genuine, compromised account, with no link and no attachment, asking for something the recipient would ordinarily do, is a business process problem before it is a technical one.
Training records evidence instruction, not judgement. A perfect completion rate is not a defence and we would not present it as one. It is one artifact among several that your Qualified Individual assembles.
Neither line supplies multi-factor authentication. Mailbox takeover is best prevented in your identity platform, and the rule requires it there.
Mailbox contents are not backed up by this family. Retention and recovery of mail is a separate line in the recovery family, and the two are frequently confused.
The words we are careful about
An FTC certification does not exist for any product, and no supplier is able to put a firm into compliance with the Safeguards Rule. That rule reaches financial institutions, and its duties settle on the Qualified Individual your own firm appoints. We sell technical services, plus the operating evidence those services leave behind, set out against the elements of 16 CFR Part 314 so that whoever signs the written program has something dated and specific to point to.
None of it promises a compliance verdict, a clean examination, or freedom from a security event, and none of it is legal advice. Which supervisor reaches your firm, what the written program has to contain as a result, and whether an event carries any duty to notify are all matters for your Qualified Individual and your lawyers.
Heads up: card statements show FORTIFY 24X7 - MoneyGuard Solutions is a Fortify 24x7 brand, and your subscription is billed by Fortify 24x7.