A radically new way of defending corporate email

xorlab helps best-in-class organizations defend against emerging email threats and automate their repetitive workflows. Here's how.


A unique approach tailored to you

xorlab monitors email communication within your environment to understand the relationships that connect your organization with the outside world. By making this communication network explicit and learning legitimate human behavior, xorlab can identify threats that others miss.


xorlab tracks sender-recipient relationships and builds a model of legitimate and trusted communication partners. This model is unique for every organization.


xorlab builds behavioral profiles to discover the file types, links, services, and content types that are typically exchanged with your trusted parties.


xorlab matches the risk of every email message against the context of the relationship, flagging anything that's beyond what should be expected.

Active Threat Defense

Complete protection against all types of email attacks

xorlab tailors its threat detection engine to the behavior of your organization to stop attacks that evade your SEG. Extend your cloud email environment or SEG with best-in-class protection against advanced attacks.


Zero-day attack protection

Protect your business against malware and ransomware, advanced phishing, business email compromise, CxO and targeted invoice fraud, and other emerging email threats.

Compromised account monitoring

Discover compromised email accounts in your own organization as well as with your suppliers, vendors, or partners.

Self-service quarantine portal

Empower your employees with the option to safely preview and release certain quarantined emails in their own employee portal.

Extended threat visibility

Get contextual information and threat insights from every email to discover attack patterns, monitor threat actors and campaigns, and compile management reports.


Stop worrying about malicious Office documents, encrypted archives, obfuscated PDF embeddings, and zero-day exploits.


Active Incident Response

Workflow automation capabilities for security teams

xorlab comes with built-in workflow automation tools designed to increase the effectiveness of your security operations.

Automated triage of user-reported emails 

Manage user submissions and automate up to 90% of analysis, response, and end-user feedback.




Campaign monitoring

Gain insights into evolving threat actor tactics and campaigns. Group similar incident reports into campaigns and track them over time.

Mailbox isolation & bulk remediation

Isolate suspicious emails, automatically uncover similar emails, and bulk remediate them across all users’ inboxes in a single click. 



Fast, contextual user feedback

Choose among different templates to respond to employees and customize your responses with case-specific commentary.

Defense orchestration

Identify potential attacks that are targeting your organization and rapidly inform 3rd-party security controls about potential threats coming their way.