AI Email Counterintelligence & Insider Threat Detection
ShadowMX is an enterprise-grade, AI-powered email surveillance and threat detection system for high-risk environments — government agencies, national SOCs, critical infrastructure, and regulated enterprises. It attaches to a centralized mirror inbox and continuously inspects every internal and external message without touching the production mail flow.
- Passive Mirror Monitoring Connects to an IMAP mirror inbox over SSL, ingesting only unseen emails while leaving the live mail system untouched.
- Content + Context Awareness Inspects headers, bodies, threads, and attachments to understand intent, behavior, and risk.
- On-Prem & Air-Gapped Fully offline deployment with zero outbound cloud calls — suitable for classified, zero-trust networks.
- Forensic-Grade Logging .eml capture, alert logs, and database records for legal, compliance, and long-term investigations.
End-to-End Email Intelligence Pipeline
ShadowMX runs a continuous loop of ingestion, analysis, and archival, turning raw communications into structured, searchable threat intelligence.
- Ingest Poll the mirrored inbox every few seconds, fetch unseen messages via IMAP over SSL, and persist them safely.
- Deconstruct Parse headers, normalize HTML/text, extract attachments (.pdf, .docx, .zip, .exe, .js, etc.), and detect spoofed domains.
- Analyze Send cleaned content to an AI + rule engine for multi-label classification, regex hit detection, and domain heuristics.
- Tag & Score Assign threat tags, 0–100 risk score, and LOW / MEDIUM / HIGH confidence for each message.
- Archive Store .eml, alerts, and metadata in a persistent archive for future audits and replay.
Hybrid AI + Rules Engine
At the heart of ShadowMX is a hybrid detection engine combining transformer-based NLP, multi-label classification, and deterministic regex signatures. This allows it to surface subtle human-language threats and hard-coded indicators in the same workflow.
- Multi-Label Classifier: Uses sentence embeddings and logistic regression heads to assign multiple threat categories per message.
- Regex Rule Engine: Detects credentials, API keys, VPN mentions, crypto wallets, and other sensitive patterns that must never leave internal networks.
- Threat Scoring: Combines AI probabilities and rule hits into a single risk score with an explicit confidence band.
- Rich Tagging: Emails can be tagged as data exfiltration, phishing/spoofing, insider collusion, financial fraud/crypto, policy violation, malware distribution, and more.
ShadowMX’s hybrid model is fully retrainable and extensible, allowing organizations to evolve detection logic as new social engineering and insider threat patterns emerge.
Analyst Dashboard, Conversation Tracing & RBAC
ShadowMX ships with a secure, cinematic Flask-based dashboard designed for SOC teams, CERTs, and compliance auditors working in sensitive environments.
- Overview Panels: Total emails processed, suspicious hits, foreign-origin traffic, and daily trends at a glance.
- Suspicious Alerts View: Time-ordered list of flagged emails with sender/recipient, threat tags, score, and drill-down actions.
- Conversation Tracing: Follow an actor’s communication thread across time to identify collusion, exfiltration planning, or coordinated phishing.
- Archive & EML Access: Search, filter, and download .eml and alert logs for forensic review and legal workflows.
- Role-Based Access Control: Admin, Analyst, and Viewer roles enforced with hashed passwords, session tokens, CSRF protection, and guarded routes.
ShadowMX is intended for deployment on authorized organizational mail infrastructure only. Unauthorized interception or monitoring of third-party communications is strictly prohibited.
