Call
Talk to an expert

Cyber Security

Email Security

Phishing, fake invoices and spoofed domains, stopped in layers: filtering, domain records, mailbox hardening and a one-click way for staff to report what slips through.

Ask about Email Security
Your mail flowSample view
  • Phishing filterCredential phishing link blockedManaged
  • ImpersonationLookalike supplier invoice heldContained
  • DMARCMove to enforcement to approveDecision needed
  • User reportsReported message removed from inboxesManaged
  • Forwarding rulesExternal forwarding rule removedManaged
  • Data loss preventionSensitive data warning shownManaged
Illustration · not live data

In short

Email security protects your organisation from phishing, malware, fake invoices and impersonation. Catharsis adds layered filtering to Microsoft 365 or Google Workspace, sets up the SPF, DKIM and DMARC records that let receiving servers reject email faking your domain, and removes confirmed threats your staff report from other mailboxes. Our Sydney team supplies, configures and supports each layer.

01Who it's for

Is email security right for you?

It suits any organisation that pays invoices or handles sensitive information by email. Attackers test their phishing against standard filtering, and lookalike domains and taken-over mailboxes need more than the defaults.

Built for

  • Any business using Microsoft 365 or Google Workspace for email
  • Finance, legal and accounting teams that handle payments and are targeted by fake invoices
  • Organisations running both Microsoft 365 and Google Workspace, for example after a merger
  • Government, health and education teams that need email controls mapped to a framework

You probably need it if…

  • Staff regularly receive phishing or fake invoice emails
  • A customer or supplier has received a fraudulent email in your name
  • You don't know whether your domain has SPF, DKIM and DMARC set up correctly
  • Your cyber insurer has asked about email controls or MFA on mailboxes

02What's included

What email security includes

Filter & respond

Phishing and malware filtering

An extra layer of filtering in front of, or alongside, your Microsoft 365 or Google Workspace protection. Links and attachments are checked before delivery, and known malicious messages are blocked.

Impersonation and invoice fraud protection

Detection of messages that impersonate your executives, suppliers or lookalike domains, the pattern behind business email compromise. Suspicious messages are flagged or held so staff think twice before paying.

User reporting and clean-up

A report button in Outlook or Gmail lets staff flag suspicious messages in one click. We review reports and remove confirmed threats from the other mailboxes that received them.

Domain & tenant hardening

SPF, DKIM and DMARC set-up

We publish and tune the DNS records that prove your emails are genuine, then move DMARC to enforcement in stages. Receiving servers can then reject email that falsely uses your exact domain.

Mailbox and tenant hardening

We review the mail settings attackers abuse: forwarding rules, legacy sign-in methods, multi-factor authentication (MFA) gaps and risky third-party app access. You get a list of fixes, and we can apply them for you.

Data protection

Data loss prevention rules

Rules that warn or block when staff send sensitive information, such as tax file numbers or health records, to the wrong place. They help you meet your obligations under the Privacy Act 1988 (Cth).

03Related work

Email security in practice

Real engagements, anonymised because our clients are under NDA. The full write-ups, with results, are on our work page.

  • Australian small business · client under NDA

    Business email compromise investigation

    An investigation and clean-up after an attacker took over a Microsoft 365 mailbox, hid a forwarding rule and emailed everyone in the user's contacts.

    • Root cause and timeline established from logs and email evidence
    • The attacker's hidden forwarding rule found and removed

See all our work

04In detail

Email security, in depth

Why does email security need several layers?

No single control catches everything. Filtering checks links, attachments and sender reputation, but attackers test their messages against common filters before sending. Impersonation detection catches lookalike domains that filtering lets through. Domain records stop others sending as your exact domain. And when something still reaches an inbox, a one-click report lets us remove it from other mailboxes.

The last layer matters as much as the first. Filtering will always miss some messages, so we pair email security with security awareness training and phishing simulations that teach staff what to look for. Email also depends on your wider tenant: our cloud and Microsoft 365 security service covers sign-in policies, sharing settings and admin accounts.

Why does DMARC need to reach enforcement?

DMARC starts in monitoring mode, where receiving servers report on email using your domain but still deliver it. That is a useful first step, because the reports show the systems that send email as you. It doesn’t stop anyone faking your domain until the policy moves to enforcement.

We move to enforcement in stages, so legitimate mail from your own systems keeps flowing while spoofed mail is rejected. ASD’s Australian Cyber Security Centre explains these records in its guidance on how to combat fake emails.

How do you protect against fake invoices?

A single changed bank detail on a supplier invoice can redirect a large payment, so we reduce the risk on three fronts. Impersonation detection flags lookalike domains and display-name tricks. MFA and sign-in monitoring make it harder to take over a real mailbox. And we help you set a simple process for finance staff: any change to bank details is confirmed by phone on a known number, never by replying to the email.

A common example: an email from a lookalike supplier domain asks for bank details to be updated. Impersonation detection flags and quarantines it before anyone acts on it, and the finance team is alerted to check the request by phone.

What should you look for in an email security provider?

Look for a provider that reviews your existing Microsoft 365 or Google Workspace settings before selling you another tool, moves DMARC to enforcement rather than leaving it in monitoring mode, and acts on the messages your staff report. Ask who reviews those reports, and how a confirmed phishing email is removed from other mailboxes.

If you would rather one team ran email security alongside your endpoint and vulnerability tools, it can sit inside managed security.

05The process

How email security works

  1. Email security review

    We check your current filtering, domain records and mailbox settings, and show you where the gaps are.

  2. Trial

    Where it fits, a 14-day email security trial shows what extra filtering catches in your own mail flow.

    14 days

  3. Deploy and harden

    We switch on protection, publish SPF, DKIM and DMARC records and apply the mailbox fixes we agreed.

  4. Monitor and tune

    We review reported messages and DMARC reports, adjust policies and report to you regularly.

06Frameworks

How this maps to the frameworks

Useful for your auditor, board or procurement team. The mapping shows where this service supports each framework. It doesn't replace a formal assessment.

Email Security: framework mapping
ControlASD EssentialsASD maturity model (current)ISO/IEC 27001NIST CSF
Phishing and malware filteringBoundary servicesNot applicableA.8.7Protect
SPF, DKIM and DMARCBoundary servicesNot applicableA.5.14Protect
Mailbox sign-in protectionIdentity servicesMulti-factor authenticationA.5.17, A.8.5Protect (PR.AA-03)
Data loss prevention rulesNot applicableNot applicableA.8.12Protect
User reporting and clean-upVisibility and responseNot applicableA.6.8Detect; Respond

07Pricing

Pricing and how to start

Pricing

Quoted for your environment

What changes the price

Final price depends on the number of mailboxes and domains, whether you need an extra filtering layer or only tenant hardening, and whether you add data loss prevention, compliance reporting or awareness training.

  • Advanced phishing, malware and impersonation filtering for each mailbox
  • SPF, DKIM and DMARC set-up for your main domain
  • One-click user reporting with threat clean-up
  • Regular email threat report
Get a quote

08FAQ

Email security, answered.

Can't see your question? Ask a specialist and get a straight answer.

Ask a specialist
Isn't the protection in Microsoft 365 enough?

Microsoft 365 includes useful baseline filtering, but it is a common target, and attackers test their phishing against it before sending. An additional layer, tuned to your organisation, catches more impersonation and credential phishing. Just as important, many tenants have settings that weaken the built-in protection. We review both, so you only pay for extra tools where they add real value.

What is business email compromise?

Business email compromise (BEC) is a scam where an attacker impersonates someone you trust, such as your CEO, a supplier or a client, to get you to pay a fake invoice or change bank details. Some attacks come from lookalike domains, others from a genuine mailbox the attacker has taken over. Because there is often no malware or link in the message, basic filters can miss it.

What are SPF, DKIM and DMARC?

They are DNS records that prove email from your domain is genuine. SPF lists the servers allowed to send your mail, DKIM adds a digital signature to each message, and DMARC tells receiving servers what to do with messages that fail those checks. Together, at enforcement, they let receiving servers reject email that fakes your exact domain. Lookalike domains need impersonation detection as well.

What does the 14-day email security trial include?

The trial adds our email filtering to your mail flow so you can see what it catches that your current protection misses. It is a proof-of-value engagement for organisations evaluating a purchase. Limits and the end-of-trial steps are confirmed in writing before the trial starts. At the end, we walk you through the results and recommend whether extra protection is worth it for you.

Will email security delay or lose legitimate emails?

Scanning adds very little delay for most messages. Attachments that need deeper analysis can take slightly longer, and we can tune that for known senders. Held messages go to a quarantine that staff or administrators can release, rather than being deleted silently. During rollout, we watch for false positives and adjust policies until legitimate mail flows normally.

Do you secure Google Workspace email too?

Yes. We secure email on both Microsoft 365 and Google Workspace. The filtering layer, SPF, DKIM and DMARC set-up and user reporting work the same way on either platform, while mailbox hardening follows each provider's own settings. If you run both, for example after a merger, we can protect them under one service.

Cyber Security

Managed Security

Your security tools run, watched and reported on by security specialists.

Talk to our team

Talk to us about email security.

No obligation. You talk to the people who do the work.

Offered at our discretion. Offer terms.