Managed email security

CACUS

Multi-layer phishing defense, built for Arabic and English inboxes.

A managed service that inspects every incoming message through fifteen independent detection layers before it reaches your people — hosted by us, connected to your mail in minutes, nothing installed on your side.

Request a pilot See how it works
Capabilities

What every message is checked against

A cascade of independent layers. A verdict is issued the moment any layer is certain, so clearly-bad mail is stopped early and the rest is weighed in full.

Fifteen-layer cascade

Blacklist, brand impersonation, typosquat, attachments, threat intelligence, YARA, credential traps, authentication, sender reputation, machine learning and a multilingual transformer — in sequence.

Arabic and English, natively

Detection rules, credential-trap phrases and a transformer fine-tuned for both languages — not an English-only engine bolted onto Arabic mail.

Attachment & document inspection

PDFs are scanned structurally for hidden JavaScript, auto-launch actions and embedded payloads — including inside compressed streams. Office files are checked for macros.

Link & threat intelligence

URLs are unwrapped through shorteners and redirects, then the real destination is checked against multiple reputation sources before it is judged.

Sender authentication, done right

SPF, DKIM and DMARC are read from the receiving server's per-message verdict — so a forged brand that merely publishes records can't pass itself off as genuine.

Impersonation & look-alikes

Catches display-name spoofing and typosquatted domains, measured against 50,000+ popular domains and a curated list of frequently-impersonated brands.

Where it works

Connects to the mail you already use

CACUS is multi-tenant and connects over the provider's own secure API or protocol. Onboarding a client means authorizing access to the mailboxes to protect — there is nothing to install for the end user.

Microsoft 365Graph API
Google Workspacedomain-wide
GmailOAuth
IMAPany provider

Each client runs in an isolated tenant with its own protected mailboxes, policy and logs.

The pipeline

One message, many decisions

A message enters, passes through decisive layers that can stop it outright and scoring layers that weigh it, and leaves with a verdict and the evidence behind it.

inbound email decisive · can stop the message blacklist impersonation typosquat attachments threat intel YARA credential trap auth spoof whitelist authenticated-sender mitigation scoring · weigh the rest sender reputation machine-learning model AR/EN transformer verdict legit phishing
Decisive — a single certain layer ends it Scoring — combined when no layer is certain
Co-managed console

Your client's team proposes. You approve.

A bilingual console lets a client's trained IT team submit brand, allow and block entries for their own tenant. Nothing takes effect until you approve it — then it applies live, with a full audit trail.

1

Client proposes

Their IT team adds a brand, a trusted domain, or a domain to block — scoped to their tenant only.

2

You review

Every submission waits in a master queue. You see who proposed what, and the evidence, before deciding.

3

Approved applies live

On approval the change is written and reloaded into detection immediately — no restart, no waiting.

Delivery models

Run it for them, or with them

Managed

We run everything

For teams that just want protection
  • Hosted, monitored and tuned by us
  • Verdicts and reports delivered to you
  • Fastest to start
Co-managed · recommended

Client curates, you approve

For enterprises and ministries that want control
  • Client's IT proposes in the console
  • You hold final approval
  • Full bilingual audit trail
Dedicated

Isolated deployment

For sensitive or sovereign environments
  • Dedicated tenant and data boundary
  • Policy tailored to the organization
  • Scoped access, per-tenant logs
Results you can read

Every verdict is explainable

Decided by a named layer
Each message carries the exact layer that decided it, a risk score, and the reasons — not a black-box label.
Logged per tenant
Decisions are recorded for each client so they can be reviewed, reported on, and used to tune detection over time.
Tuned to avoid false alarms
Legitimate, authenticated mail is recognized so real business messages are not blocked — a verdict is only decisive on strong evidence.
verdict { label: "phishing" decided_by: "typosquat" score: 0.94 reasons: ["look_alike_domain", "credential_request"] layers_run: 6 of 15 }

Detection accuracy is established on each client's own mail during a pilot, not quoted from generic benchmarks. We report real figures from your environment before you commit.

Start with a pilot on your own mail

Connect one mailbox or a whole domain, run CACUS in parallel for two to four weeks, and see what it catches before anything changes for your users.

contact@almada.biz

Almada Data Security · Tripoli, Libya