Organization Protection Guide

Phishivox helps teams investigate suspicious email, understand why a message was flagged, and improve their security response. Organizations can connect supported Microsoft 365 or Google Workspace mailboxes for monitored detection without changing MX records or DNS.

What is available today

• Message analysis — Upload an .eml file, enter message details manually, or use a supported mailbox connection to obtain a verdict and evidence.
• Organization monitoring — Connect Microsoft 365 or Google Workspace and verify the connection status before relying on monitoring.
• Explainable results — Review verdict, score, confidence, contributing signals, and available recommendations before taking action.
• Team operations — Invite members, assign organization administrators, review shared activity, and maintain an audit trail for supported actions.
• Optional Gmail quarantine — Google Workspace administrators can explicitly authorize gmail.modify and turn on reversible label-based quarantine. It is off by default.
• Phishing simulations — Create and measure internal awareness campaigns from the security workspace.

Complete these steps in order. Connection setup alone does not mean monitoring is active.

Before you start

• Create the organization and make at least two trusted users organization administrators.
• Confirm the organization name, billing owner, and support contact.
• Choose the provider you use for organizational mail: Microsoft 365 or Google Workspace.
• Use an appropriate provider administrator: Microsoft 365 Global/Exchange Administrator, or Google Workspace Super Admin.

1. Configure the connection

1. Sign in as an organization administrator and open Set up email security.
2. Select your provider and provide the requested organization information.
3. For Microsoft 365, complete the Microsoft administrator consent flow.
4. For Google Workspace, enter the Workspace domain and Super Admin verification mailbox. Add the displayed Phishivox OAuth client ID and the displayed gmail.readonly scope in Google Admin Console domain-wide delegation.

2. Verify, then check status

1. Select Verify connection.
2. Wait for the status to show monitoring/detection as active. If it is degraded, correct the displayed error and verify again.
3. Send a safe test message only after the connection is protected; confirm it appears in the relevant security view.

Phishivox combines message content, sender and header signals, URL and attachment indicators, and available AI-assisted analysis to return an explainable verdict. A verdict is decision support: always review the underlying evidence before taking a business-critical action.

Verdicts

Recommended response

1. Open the result and review the sender, subject, verdict, score, confidence, and available findings.
2. For suspicious or phishing results, do not interact with embedded links or attachments from the original message.
3. Record the decision in your internal incident process and preserve the original message when escalation is required.
4. Use a rescan when new context is available or your plan now includes additional analysis capabilities.

Use the scan detail as an investigation workspace, not as a replacement for your incident-response policy.

What to review

• Identity signals — sender and reply-to addresses, display name, and available authentication/header evidence.
• Intent and content — urgency, payment or credential requests, impersonation, and unexpected workflow changes.
• URLs and attachments — inspect the evidence rather than opening risky content from the original email.
• Confidence and findings — use them to prioritize review, not as a guarantee of safety or maliciousness.

Escalation checklist

1. Preserve the original message and its headers.
2. Notify the recipient not to interact with the message.
3. Validate sensitive requests through an independent channel, such as a known phone number or an existing ticket.
4. Document the outcome in your organization's incident record.

Google Workspace quarantine is an optional, reversible control. It is disabled by default. When enabled, eligible detected messages are given the Phishivox/Quarantine Gmail label and removed from the Inbox. Messages are not deleted.

Enable it safely

1. Complete normal Google Workspace monitoring setup and verify that monitoring is active.
2. In Google Admin Console, have a Workspace Super Admin add https://www.googleapis.com/auth/gmail.modify to the existing Phishivox domain-wide delegation authorization.
3. Return to Set up email security in Phishivox and select Authorize gmail.modify and enable quarantine.
4. Phishivox verifies that authorization live before enabling the organization setting.

Operational safeguards

• Only turn this on after your team has agreed on an escalation and review process.
• Review detections and follow your approved provider and incident-response process when a message is legitimate.
• Turn the feature off immediately from onboarding if you need to return to monitor-only operation.
• Failed quarantine actions remain visible as detection events; a failure does not mean a message was moved.

Test your organization's phishing awareness by sending simulated phishing emails to employees. Track who clicks, measure awareness levels, and export results for targeted cybersecurity training.

How It Works

1. Choose from 5 built-in templates (BEC, password expiry, delivery scam, invoice fraud, Microsoft security alert) or create your own custom template.
2. Add recipients by pasting email addresses, or import from your M365 directory.
3. Send a test email to yourself first to verify the template looks realistic.
4. Launch the campaign — simulation emails are sent through your org's M365 tenant (or via Resend fallback).
5. When employees click the simulated phishing link, their click is logged and they see an educational landing page.

Campaign Dashboard

Real-time metrics show how many emails were sent, opened, and clicked. The campaign detail page breaks down results per recipient with exact timestamps.

Training Assignment

Export a CSV of all employees who clicked the simulated phishing link. Use this list to assign targeted cybersecurity awareness training to the employees who need it most.

Templates

• CEO Wire Transfer (Hard) — BEC attack requesting urgent payment
• IT Password Expiry (Medium) — Fake password reset with countdown
• FedEx Delivery (Easy) — Package delivery failure notice
• Vendor Invoice (Medium) — Fake invoice with payment link
• Microsoft 365 Alert (Hard) — Suspicious sign-in from another country

Creating Custom Templates

You can create your own simulation templates tailored to your organization's industry, tools, and common attack scenarios. Custom templates use HTML for the email body and support these personalization placeholders:

• {{TRACKING_URL}} — Required. The trackable link that logs clicks. Place this in your CTA button or anchor tag.
• {{FIRST_NAME}} — Recipient's first name (extracted from display name or email). Falls back to "Team Member".
• {{COMPANY_NAME}} — Your organization's name as set in Phishivox. Falls back to "Your Company".
• {{EMAIL}} — Recipient's full email address.

Example 1: IT Software Update

Subject: Mandatory: Install critical security update by EOD

Body HTML:

Example 2: HR Benefits Enrollment

Subject: Action Required: Open enrollment closes Friday

Body HTML:

Example 3: Shared Document (Plain Text Style)

Subject: John shared "Q2 Budget Review.xlsx" with you

Body HTML:

Tips for Effective Simulation Templates

1. Match your org's real tools — If your company uses Slack, create a "Slack notification" template. If you use Jira, create a "Jira ticket assigned" template.
2. Use urgency but keep it believable — "by end of day" is more realistic than "in 1 hour or your account is deleted."
3. Test difficulty levels — Start with "easy" templates (obvious red flags) and progress to "hard" (very convincing) over multiple campaigns.
4. Always include {{TRACKING_URL}} — Without it, there's no way to track who clicked.
5. Set the right difficulty rating — This helps you analyze results by difficulty and track improvement over time.

Daily administrator checklist

1. Review new suspicious and phishing detections in the security workspace.
2. Open the result, validate the evidence, and notify affected users through your established response process.
3. Check connector status. Investigate any disconnected or degraded connection before relying on monitoring.
4. Review audit activity for high-impact actions and maintain your organization's case records.
5. Review simulation results after campaigns and use them to plan awareness training.

Weekly administrator checklist

• Confirm two or more trusted users retain organization-admin access.
• Review pending invitations, team membership, and any provider authorization changes.
• Check billing status, next renewal, and payment method before the billing date.
• For Gmail quarantine, sample released and quarantined messages to validate the operating process.

Tenant administrators can use Security Operations → System Health to confirm whether core services are healthy, including AI Gateway and the shadow pipeline.

What "AI Gateway" means

• Operational — AI-assisted analysis is available for your organization.
• Not configured — AI provider credentials are not active for the environment.

What "Shadow pipeline" means

• Operational — background parity analytics are receiving production traffic.
• No data — no eligible events have been recorded yet for your tenant.

Shadow pipeline analytics are used for quality and observability. They are designed to be non-disruptive to normal tenant operations and do not require tenant admins to change end-user mail routing.

Quick tenant-admin verification steps

1. Open System Health and confirm API, Worker, PostgreSQL, Redis, and Queues are operational.
2. Check AI Gateway status for your environment.
3. Send or scan a safe test message and recheck Shadow pipeline status after processing time.
4. If either status remains degraded or empty unexpectedly, collect timestamp + screenshot and contact support.

Organization administration

• Manage your organization name, users, roles, and invitations from the organization area.
• Limit organization-admin access to people who need to manage members, provider connections, or billing.
• Remove access promptly when responsibilities change and retain at least two administrators for continuity.

Security Operations guide (important)

• Email Explorer is your full searchable tenant message history. Use row-level Create case to open manual investigations from specific messages.
• Threat Inbox is a triage queue and shows actionable verdicts (suspicious, phishing, spam, malicious), not the full archive.
• Threat Intelligence combines observed indicators with source-managed feeds. Platform admins can add global sources; org admins can add tenant sources using URL or CSV.
• Settings and Policy Engine include guided templates/examples. Start with Apply Template/Example, then adjust values for your environment.
• Original email is available on the message detail page only to active Tenant Admins, Security Admins, and Analysts in that organization. Platform-admin status alone does not grant content access.

Viewing and downloading original emails

1. Open a message from Email Explorer and find the Original email panel.
2. Select View original for a text-only preview and attachment names. Scripts, remote images, and active links are not loaded. Viewing is recorded in Audit Logs; no reason is required.
3. Select Download original (.eml), enter an investigation or business reason, then confirm. The download preserves the available original MIME and attachments.
4. In Audit Logs, filter actions by original_email. Entries identify the actor, message, timestamp, outcome, and download reason. An issued download means the server released the file, not that the browser confirmed saving it.

Originals may be retrieved from connected organization Google Workspace or Microsoft 365 mailboxes, or from retained raw evidence for other organization sources and submissions. Deleted messages, expired evidence, disconnected providers, or messages without a retained original or reliable provider reference may be unavailable. Personal-mailbox content remains private. A parsed scan summary is never presented as a reconstructed original; preview truncation does not truncate the downloaded original.

Billing and subscriptions

1. Open Billing & Subscription as an organization administrator.
2. Review the plan, mailbox quantity, billing interval, currency, and trial end date before checkout.
3. Choose whether to start now or, when eligible, start after the trial ends.
4. Complete the Razorpay checkout window. A subscription is not active until payment authorization succeeds.
5. Use the payment-method and subscription status areas to confirm the authorization and next billing date.

When to contact support

Contact support@phishivox.com with your organization name, the page or action that failed, the approximate time, and any visible reference ID. Do not email passwords, payment card details, OAuth tokens, or full sensitive email content.