When HOPLONai Email Security flags a phishing, BEC or malware email, check the severity, contain the threat, then work out how many people were targeted and close the gap.
HOPLONai gives growing businesses a complete security operation: the tools, and the agentic AI team that operates them.
This playbook covers severity triage, the response for each level and the changes to make afterwards.
What triggers an email security alert?
Trigger: an Email Security alert in HOPLONai.
Input: the alert data, including severity, affected mailboxes, attack type (phishing, BEC or malware), attachments and the users involved.
How severe is the email alert, and what should you do?
Severity | Typical triggers | Actions |
|---|---|---|
High | Known malware, confirmed phishing, business email compromise (BEC), credential harvesting, or a fraudulent email reported by a user. | Block the sender domain and IP. Investigate the email headers and find every affected user. Notify them, and reset passwords where there is evidence of compromise, such as the account appearing in a past data breach. |
Medium | Suspicious email with phishing or malware indicators; an unknown sender with weak SPF, DKIM or DMARC; minor anomalies in email behaviour. | Notify the security team and monitor user activity for signs of account compromise. |
Low | Spam, marketing emails or repeated newsletters. | No action. |
How many users were targeted?
One user: notify them and suggest security awareness training.
Several users: block the sender and alert IT.
One user targeted repeatedly: run a phishing simulation and phishing awareness training for that user with the Human Risk module.
Repeated attacks across the organisation: review email filtering rules, enforce DMARC and run company-wide security training.
What should you change after the incident?
High severity, or a VIP involved: block the domain and IP.
Persistent attacks on one user: enforce phishing training.
Several users targeted: tighten your filtering with email detection and whitelist rules.
Excessive spam: update blocklists and teach users good email hygiene.
Frequently asked questions
What is business email compromise (BEC)?
Business email compromise is a scam in which an attacker impersonates an executive, supplier or colleague by email to trick staff into paying money or sharing data. BEC emails often carry no link or attachment, which is why they get past basic filters.
How do I release an email HOPLONai blocked?
Enter the message ID in Email Security Insights, then use Email Release. See the Email Security module guide.
Does HOPLONai check SPF, DKIM and DMARC?
Yes. The Email Security module checks SPF, DKIM and DMARC alongside phishing and BEC detection.
Which HOPLONai package includes Email Security?
The Premium package.
HOPLONai is agentic MDR — the security tools a growing business needs, and the AI team that runs them.
See Email Security in action: book a platform tour at hoplonai.com.