IRONSCALES

IRONSCALES is an email security platform for MSPs. It scans every mailbox of a customer’s Microsoft 365 or Google Workspace, groups suspicious mail into incidents, and removes the mail from every affected mailbox. When an incident is classified safe, IRONSCALES puts the mail back. Each of your clients is an IRONSCALES company under your partner account. Connect it, and Neo agents can find the email a user says was blocked, check whether it is safe, and release it from the ticket.

​

What Neo can do with IRONSCALES

• Blocked and quarantined email: find the incident that holds the email a user reports, from a release request, the incident number (IS-…) or the sender and subject
• Analysis: read the incident’s sender, reply-to address, SPF result, sender reputation, link and attachment scans, IRONSCALES’ AI verdict and how other companies classified it
• Release or remove: classify an incident safe, which puts its mail back in every affected mailbox, or phishing, which removes it; or release one user’s copy only
• Allow list: add, change and remove allow list entries for a sender, a domain or an IP network
• Mailboxes: check that a user’s mailbox is protected, add mailboxes, tag them, and run the directory auto-sync
• Account takeover: read takeover incidents, sign a compromised user out of Microsoft 365 or disable the account
• Awareness training: read campaign results and each user’s training record, and create, approve and stop campaigns
• Alert recipients and companies: set who is emailed about incidents, and read each company’s licence and statistics

See IRONSCALES API for the permission groups.

​

Your companies are mapped to your PSA companies

Neo matches your IRONSCALES companies to the companies in your PSA and keeps the mapping on the IRONSCALES card’s Organization Mapping tab, refreshed on each PSA metadata sync. Matching uses the company name: exact, then after stripping a legal-form suffix (Ltd, Inc, LLC). Next comes the company’s mail domain against a PSA company’s website. Last comes an AI match for the long tail. A name match, or one you confirm, is handed straight to your agents. A domain match or an AI match is not handed to your agents automatically. It shows on the Organization Mapping tab, where you can confirm or correct it. Anything Neo could not match stays unmapped and visible on the same tab, where you can set the right company by hand. A mapping you set by hand survives every later sync. On a ticket, an agent works in IRONSCALES only on the company mapped to the ticket’s company. A company with no mapping that agents can use gets no IRONSCALES calls until you set or confirm one on the tab. Agents with no ticket, such as a chat or a scheduled report, reach every company. A customer that holds its own IRONSCALES account can get its own Company Token on the card (Add a customer’s own key). That token reaches only the IRONSCALES company mapped to that customer, so map the customer on the tab first.

​

Who a release is recorded under

IRONSCALES records every classification under the email of an IRONSCALES user. Name that user in the agent’s instructions, for example “Classify IRONSCALES incidents as soc@yourmsp.com”. In a chat, the agent uses the technician it is working with. Without one, the agent does not release: it puts what it found on the ticket for a technician.

​

Next steps