Almost every loss at a small firm begins with a message that read as ordinary. Altered bank details. An invoice arriving a day early. A supplier who has started writing slightly differently. Two lines at this chair: cover that lives within the tenant you already paying Microsoft or Google for, plus drills that make the trick fail on the fourth try.
Protection here works down where the mailbox is, over an API, and calling it a gateway would be plain wrong. Spend ten seconds on the distinction. A gateway stands ahead of the mail and rules once on every message travelling by. Afterwards it is finished, and it cannot reach the thing again.
Wiring in over an API instead means a delivered message stays within reach. When something turns out to be hostile an hour later, or a member of staff flags it, the copy sitting in every affected mailbox can be pulled back out. That is the half a gateway cannot do, and it is precisely the half that counts when the trick was a good one.
Practice messages go out to your staff and a few minutes of teaching goes to whoever bites. No table of who fell for what gets published, because the one thing a table reliably produces is people who stop flagging things.
The useful output is quieter than that: which trick keeps working in your firm, which team keeps meeting it, and whether flagging is going up. A shop where somebody says the word without worrying about looking daft is measurably harder to rob than one where everybody passed a test last quarter.
Billing supplies each figure below as the page draws. Add a line and it sits on the board while you read further down.
Ironscales wires into a tenant already yours and works right at the mailbox, over an API. Gateway is not the word for it. Operating from within means a message that arrived an hour ago remains inside reach. Drills come bundled in.
| Position | Mail console, wired inside your Microsoft or Google tenant |
|---|---|
| Watches for | People being impersonated, payment details being redirected, mailboxes going quiet in the way a borrowed one does |
| Log kept | Each quarantine, each release and each staff report, filed per mailbox |
| Escalation path | Staff reports queue at the console; a suspected takeover rings your contact at once |
| Sign-off | An engineer rules on the message and records what was pulled and from where |
Practice messages, sent on a rota, with a few minutes of teaching for whoever bites. There is no league table, because a league table teaches staff to stay quiet. What you want is the fourth attempt failing because somebody recognised the shape of it.
| Position | Mail console, drill rota |
|---|---|
| Watches for | Which trick keeps working on your firm, and which team keeps meeting it |
| Log kept | Results and finished lessons per person, held while the subscription lasts |
| Escalation path | Anyone biting repeatedly is raised quietly with whoever manages your staff |
| Sign-off | You approve the rota; we run it and report what came back off it |
Mail is how most small firms get robbed, and it is the category this trade oversells hardest. The honest shape of these two lines is set out below.
Heads up: card statements show FORTIFY 24X7 - SecureOps Solutions is a Fortify 24x7 brand, and your subscription is billed by Fortify 24x7.