Money leaving a small firm by accident nearly always leaves through a mailbox. Nothing clever about it: a letter that looked ordinary, arrived at a believable hour, and asked for something the reader does most weeks in any case. Both lines here exist to make that harder to pull off.
Ironscales attaches over API to whichever tenant is already in use, Microsoft or Google. A gateway it is not, and the distinction is no quibble, since it settles what the thing can get at. Screen at the door and a letter is gone from view the moment it passes. Live in the room and one that landed an hour ago is still within reach.
That is what makes lifting letters back out possible. Once something is judged bad after the fact, it can be taken from every mailbox holding it, including the copies that got there because a colleague forwarded it in perfectly good faith. Internal forwarding is how one success turns into an office wide one.
An annual hour of security training is paperwork, not a control. What shifts behaviour is a brief, pointed lesson given to one person soon after they nearly fell for something, repeated often enough to bed in.
The lessons line posts staged attempts on a calendar and hands out further work from what comes back. It reports by person and by team, which gives a manager somewhere to aim rather than a vague wish that everyone were more careful.
Every figure below leaves billing at the moment this page opens. Anything laid on the service card sits waiting there while you carry on reading.
One word in the tables below needs pinning down. Certified by names the person who did the work and put their name beside it, which is how a watchmaker certifies a service. It carries no claim that Fortify 24x7 holds a security certification, and buying a line confers none on your business either.
Ironscales operates from within the mailbox, over API. Describing it as a gateway would be inaccurate, and that is no quibble: something living in the room can still retrieve a letter opened an hour back and forwarded twice since.
| Serviced on | Microsoft 365 and Google Workspace mailboxes, reached over API from inside |
|---|---|
| Regulates | What survives in a mailbox, and what gets lifted out again after arrival |
| Interval | Judged on arrival, with lesson rounds running on a repeating calendar |
| Adjusted by | Our engineers, guided by what your own staff keep reporting to us |
| Certified by | Lift outs and lesson results are entered against each mailbox |
The teaching half on its own. Brief lessons aimed at the people the figures point to, rather than one long annual sitting that everybody forgets before the kettle boils.
| Serviced on | Named staff on the Microsoft 365 or Google Workspace tenant you run |
|---|---|
| Regulates | How often people are put to the test, and who is given more work afterwards |
| Interval | Rounds on a repeating calendar rather than one sitting a year |
| Adjusted by | You choose the rhythm, we build the rounds and read the figures back |
| Certified by | Results per person are kept and reported to whoever owns the training |
Each of the six sheets carries a block like this one. It is the section most suppliers quietly omit, and it is the section that settles whether you feel let down in a year.
Heads up: card statements show FORTIFY 24X7 - ServiceTrust Cyber is a Fortify 24x7 brand, and your subscription is billed by Fortify 24x7.