EMAIL GUARDIAN™ · MULTI-LAYERED SECURITY FROM THE CLOUD

Avoid the dangerous domino effect

Email Guardian protects companies from email threats to prevent cybercriminals from using it as a gateway.

0detection and blocking
< 4 saverage delay per email
0service interruptions in 12 years
EUmultiple Tier III++ data centres in Europe, no third-party clouds

DIAGRAM · THE JOURNEY OF AN EMAIL

bidirectional SMTP relay · inbound and outbound
Internetlegitimate senders
and attackers
EMAIL GUARDIAN · TIER III++ DATA CENTRES IN EUROPE
01IP & domain reputation
02SPF · DKIM · DMARC
03Content & AI
04Attachments & multi-AV
05Sandbox < 3 s
06Anti-fraud & DLP
Your mail serverM365, Workspace,
Dovecot, Cyrus…
DELIVEREDQUARANTINEBLOCKED + ALERTAES256 ENCRYPTED COPY · 5 DAYS (SPOOLING)

MULTI-LAYERED FILTERING · TEN ENGINES IN SERIES

Thousands of elements examined in every message

Email Guardian uses detection and filtering technology developed entirely by Iberlayer, which examines thousands of elements in every message to determine its security. Our technology guarantees 99.99% detection and blocking of spam and malicious email.

Each layer discards the obvious and refines the doubtful. What reaches the last layer is what no antivirus knows yet.

L1
IP and domain reputationWhere are they? Who uses them? For what and how?
L2
SPF, DKIM, ARC and DMARC authenticationDetects domain spoofing at the source
L3
Domain monitoringTyposquatting, lookalike or newly registered domains
L4
Context, text and grammar with AIWritten by a person, an app or an AI engine? For what purpose?
L5
URLs, images and QR codesChecks in series on every link, image and QR code
L6
Attachments · multi-engine antivirusSeveral engines in parallel, even with encrypted files
L7
Real-time sandboxDetonation in under 3 s: zero-day and ransomware
L8
Virtual patchesBlocks exploits against unpatched phones and computers
L9
Anti-fraud: CEO, BEC, payroll, account changesBank certificates, tampered PDFs, fake senders
L10
DLP · data leakageSensitive data in outgoing email and attachments
DeliveredQuarantineBlocked

TRUST IN EACH ATTACHMENT

File analysis, even when encrypted

Email Guardian analyses attachments in depth and is capable of analysing even encrypted files, extracting data, metadata, QR codes, URLs, cryptocurrency wallets, etc. It includes multi-engine AV and real-time sandboxing, which blocks and prevents attacks early, including zero-day attacks and ransomware.

IN
Attachment received

PDF, Office, ZIP, image… even password protected.

STEP 1
Decryption and extraction

Texts, metadata, QR, URLs, wallets.

STEP 2
Multi-engine antivirus

Several engines in parallel.

STEP 3
Sandbox < 3 s

Detonation for the unknown.

OUT
Verdict + MITRE

Deliver, quarantine or block.

Extracts attachments even when encrypted or compressed in several levels: ZIP, RAR, 7z, Office and password-protected PDF
Recognises images, videos, documents and code, and applies to each type the analysis it needs
De-obfuscates disguised scripts, macros and executables: detects the language and evaluates what the code does
Detonates in a real-time sandbox anything no antivirus engine knows yet
Inspects PDFs in depth: JavaScript, forms, objects and hidden layers
Reads images and videos: OCR of text, QR codes, hidden links, metadata and steganography
Verifies the real file type: the content must match the extension
Traces every threat to its MITRE ATT&CK vector ID and shares IOCs with your EDR

FRAUD PROTECTION

Fraud detection before it costs money

Email Guardian recognises document manipulation, false return addresses and spoofing used in social engineering attacks such as CEO fraud or payroll fraud.

It protects against bank fraud by monitoring conversations about collections and payments, analysing the validity of alleged bank certificates and detecting suspicious requests to change account numbers.

  • CEO and payroll fraud
  • Banking fraud and bank account changes
  • PDF manipulation and SIM cloning
  • Immediate phone alert in urgent cases

DIAGRAM · ANATOMY OF A CEO FRAUD

ATTACKERceo@company-inc.comlookalike domain · typosquatting · newly registered
Email Guardiandetects · blocks · calls
TARGETFinance dept."Urgent: change the account for this payment"
SIGNALDomain one character off the real one
SIGNALRegistered 3 days ago
SIGNALUrgent payment to a new account
SIGNALSender who never wrote to finance

ARCHITECTURE AND INTEGRATIONS

100% European cloud, connected to your ecosystem

No hardware or software. Operational in minutes, scalable to the largest organisations and with a written availability SLA.

MAIL PLATFORMS

Microsoft 365
Google Workspace
Dovecot
Cyrus

Identification and remediation API: removes malicious content already delivered.

Email Guardian
DCTIER III++
DCTIER III++
···multiple in Europe
EUROPE · NO THIRD-PARTY CLOUDS
GDPR · ISO 27001 · ENS HIGH

YOUR SECURITY TEAM

Web console2FA · 1 year of logs · tenth-of-a-second search
SOCreal-time encrypted logs + MFA control API
EDRCrowdStrike, Palo Alto, SentinelOne · IOC exchange
Alertsperiodic reports · phone call if serious

DIAGRAM · VARIANTS OF YOUR DOMAIN

company.com

ACTIVE PREVENTION

PASSIVE PREVENTION

cornpany.comrn imitates m · registered 2 days agoALERT
ceo@company-inc.comadded suffix · payment requestBLOCKED
сompany.comCyrillic c · Unicode homoglyphALERT
company.com.login-x.netdeceptive subdomain in a linkBLOCKED
company.coalternative TLD · availableWATCHED
mary@company.comSPF · DKIM · DMARC alignedDELIVERED

DOMAIN SECURITY · ACTIVE AND PASSIVE PREVENTION

Homoglyph domain monitoring

Cybercriminals register domains almost identical to yours to steal credentials, impersonate your management or divert payments: one letter changed, a hyphen added or a character from another alphabet that looks the same (homoglyph domains). Registering a domain is trivial; spotting it with the naked eye is not.

Email Guardian combines two proprietary technologies: active prevention, which continuously generates and watches the variants of your domains (typosquatting, Unicode homoglyphs, IDN, alternative TLDs) and alerts you as soon as someone registers one; and passive prevention, which analyses in real time every sender, link and QR code in incoming email to block those using lookalike, newly registered or fraudulent domains before they reach the user.

DIAGRAM · WHAT WE ANALYSE IN EVERY LINK

before delivering the email
INLink in the email
ANALYSISChecks in series
DeliveredBlocked
●Structure analysissyntax, redirects, anomalous parameters
●IP and domain analysisreputation, age, owner
●Remote server vulnerabilitiesexposed software, versions, configuration
●Probability of being hackedrisk score of the destination site
●Content analysistext, forms and downloads on the page
●Shortener analysisfull resolution of the redirect chain
●Obfuscation detectionencoding, deceptive characters, punycode
●Spoofing detectionimitated brands and domains
●Fake login detectionpages imitating access portals
●QR codes and imageslinks embedded in images and QR codes

CONTINUITY · TEMPORARY SPOOLING

AES256 encrypted copy
DAY 1encrypted copy
DAY 2encrypted copy
DAY 3encrypted copy
DAY 4encrypted copy
DAY 5encrypted copy
If your server goes down, the mail is delivered when it recovers. Nothing is lost.

SECURITY IN EVERY LINK

URL analysis and continuity

Every link in every email goes through multiple checks before delivery: structure, IP and domain, remote server vulnerabilities, probability of the site being hacked, content, shorteners, obfuscation, brand spoofing, fake login forms and links hidden in images and QR codes. If a single one fails, the email does not get through.

Email Guardian also includes a temporary mail spooling service, keeping an AES256-encrypted copy of all messages for up to 5 days, guaranteeing their restoration in the event of failures in the customer's infrastructure.

DIAGRAM · WHERE YOUR EMAIL LIVES

0 transfers outside the EU

YOUR ORGANISATION

Users
Mail server
SOC / SIEM
Email Guardian
DCEurope · own
DCEurope · own
···multiple centres
OPERATED BY IBERLAYER
NO HYPERSCALERS · NO THIRD-PARTY CLOUDS

GUARANTEES

GDPREuropean jurisdiction✓
ENS HIGH categoryCCN CPSTIC catalogue✓
ISO/IEC 27001:2022certified by AENOR✓

100% EUROPEAN CLOUD · FULL DATA SOVEREIGNTY

Cloud service, with your email always in Europe

Email Guardian is delivered from multiple Tier III++ data centres of our own in Europe, operated by Iberlayer. No hyperscalers, no third-party clouds and no international transfers: your email, attachments and logs never leave the European Union and remain under European jurisdiction, in compliance with the GDPR and qualified for the ENS at HIGH category.

No installation, maintenance or software or hardware updates. We guarantee availability and performance in writing (SLA), and the service scales effortlessly for the largest organisations, absorbing traffic peaks or a significant increase in users.

DIAGRAM · WHAT HAPPENS IN A SERIOUS INCIDENT

CEO fraud · example
09:30CEO fraud attempt detected and blockedbank account change · domain registered 3 days ago
09:31An Iberlayer technician phones your contact personso the finance team is warned before anyone opens anything
09:40Incident report available in the consoleMITRE ATT&CK vector, IOCs shared with your EDR
SUPPORTa single level
HOURS24 h · 365 days
WHOIberlayer technicians · EN / ES

A SERVICE, NOT A PRODUCT

Behind every email there is a team, not a licence

Email Guardian is not a box or a piece of software you install and forget: it is a service operated every day by the same engineers who designed it and maintain it. When we detect a serious incident, such as a CEO fraud attempt or a bank account change, we do not just block it: we phone you so your team can act before anyone opens anything.

Support is handled by Iberlayer technicians at a single level, 24 hours a day, 365 days a year, in English and Spanish: whoever answers is whoever solves it. No external call centres, no intermediate tiers and no tickets to escalate. New protections and updates are added to the service without you having to do anything.

ALL FEATURES

The most complete and simple email protection on the market

Reputation analysis

Control of each and every IP and domain: where are they? who uses them? for what and how?

Context analysis

Why this email and for what purpose? What is it about and how? Is it written and sent by a person, an app, an AI engine?

Attachment analysis

Multiple antivirus engines to detect all types of malware, even in encrypted attachments.

Real-time sandbox

Sandbox (< 3 s) for all possible threats not detected by AVs and zero-day threats.

Anti-fraud protection

CEO, payroll and banking fraud: PDF manipulation, account changes, SIM cloning.

Anti-phishing protection

Advanced protection against phishing and identity theft. SPF, DKIM and DMARC control.

Link analysis

Structure analysis, URL tracking, vulnerability detection and remote risk levels.

Image analysis

Analysis of texts, metadata and characteristics. Complete QR and barcode parsing.

AI applied to security

Powerful autonomous AI engine for analysis of user behaviour, texts and grammar.

Virtual patches

Prevents the exploitation of vulnerabilities in outdated smartphones and desktop computers.

DLP

Helps prevent and mitigate data leakage through email and attachments.

Web console

Real-time web console with 2FA and 1 year of logs, searchable in tenths of a second.

URL analysis

Structure, remote server, shorteners, obfuscation, spoofing and fake logins.

Identification and remediation

API integration with M365, Google Workspace, Dovecot and Cyrus to identify and remove malicious content.

MITRE traceability

Identifies and displays the vector IDs associated with each detected threat.

EDR integration

Native integration with CrowdStrike, Palo Alto and SentinelOne for IOC exchange.

Cloud service

100% European cloud. No hardware or software required. Easy to set up. Operational in minutes.

Maximum performance

Average delay injected into emails of less than 4 seconds. Zero service interruptions in 12 years.

Very low ROI

Single licence type with everything included from the start, based on number of users and at a very competitive price.

24/7 support

Single-level technical support, served by Iberlayer technicians 24 hours a day, 7 days a week, in English and Spanish.

HOW DOES IT WORK?

As simple as adjusting your company's MX records

The whole process only takes a few minutes and is coordinated between Iberlayer and the customer.

1Customer registration

Once registration is completed, the customer's domains are already accepted by Email Guardian.

2MX change

Coordinated between Iberlayer and the customer. A few minutes.

3Protected!

Protected and safe customer. Nothing to install.

BEFORE · DNSyourcompany.com. MX 10 mail.yourcompany.com.
→ direct attacks on your server
AFTER · DNSyourcompany.com. MX 10 mx1.emailguardian.
yourcompany.com. MX 20 mx2.emailguardian.
→ all email goes through Email Guardian

SEE IT IN ACTION

It only takes one click on a malicious email to put your entire organization at risk

Request a real test

Start protecting your email today. Fill out the form and our experts will arrange a free demo session for you.

  • Stop email attacks in real time
  • Easily identify the most threatened user accounts
  • Automatically stop data leaks and security threats
* Required fields