Ironscales

A secure email gateway stops what is already known. The attacks that land in South African inboxes now are different: a supplier asking you to change their banking details, a finance request in your own chief executive's writing style, a QR code in a PDF, a login page that looks exactly like your tenant. None of those carry malware, so a gateway has nothing to match against. Ironscales sits behind whatever you already run, scans the message once it is in the mailbox, and compares it against how your people actually communicate. It is a three-click API integration, so there is no MX record change, no mail re-routing and no endpoint agent, and because it works at mailbox level it also sees internal mail, which is exactly where a compromised account does its damage.

What Ironscales does

Adaptive AI detection

Builds a behavioural baseline and a social graph for every user with NLP and NLU, so impersonation and tone shifts are measurable, and uses computer vision to catch fake login pages and spoofed logos that carry no link or attachment.

Themis, the agentic AI virtual SOC

Investigates, clusters and remediates threats across every affected mailbox in seconds, with thresholds you set from supervised through to fully automatic. Ironscales reports that it removes over 99 percent of the manual email security workload.

BEC, ATO and impersonation protection

Account takeover detection uses the Microsoft 365 Graph API to watch for anomalous account activity in real time, going beyond Active Directory events to individual user behaviour, with one-click remediation from desktop or mobile.

QR code and generative AI attack protection

Multi-modal AI scans URLs embedded in QR codes, and adaptive detection covers phishing written with generative AI as well as lookalike domains registered to resemble one you trust.

Link and attachment scanning

Deep inspection through more than 100 independent scanning engines, continuously re-checked so time-detonated payloads that were clean at delivery are caught when they change.

Outbound security and DMARC

DMARC, SPF and DKIM management with automated policy enforcement and SPF record flattening, sender-initiated AES-256 email encryption, and data loss prevention with pre-built HIPAA, PCI and GDPR templates.

Microsoft Teams protection

Scans links and attachments shared in Teams, where people drop their guard because the channel feels internal, with incidents managed in the same console.

Security awareness training and simulation

Over 100 training videos in more than 10 languages with autonomous monthly campaigns, phishing simulations personalised to each employee's risk profile, dynamic warning banners, a one-click report button and the Themis Copilot assistant in Outlook.

Crowdsourced threat intelligence

Detection is reinforced in real time by threat data from a community of more than 17,000 customer organisations, so an attack seen once is recognised everywhere.

Ironscales plans

Email Essentials

Foundational inbound email security.

Email Protect

Comprehensive inbound email security.

Email Protect Pro

Inbound and outbound, adding DMARC management, encryption and data loss prevention.

Complete Protect

Inbound email security with human risk management, account takeover protection and Microsoft Teams security.

Human Risk Management

Phishing simulation and security awareness training.

Who Ironscales is for

Organisations on Microsoft 365 or Google Workspace that are still seeing phishing reach the inbox despite a secure email gateway, finance and payroll teams targeted by invoice and banking detail fraud, and IT teams without the capacity to chase a phishing campaign mailbox by mailbox.

Common questions