CYBERSECURITY MONTH 2026
The banner alerts. The analysis button explains. Your people learn.
The MailWatch vigilance banner flags the risky situations you have chosen, in real time and right inside the email, without calling an external AI. When doubt remains, employees request an in-depth analysis themselves, and it explains the clues. Every doubt becomes a lesson.
- Nothing leaves your mailbox without an employee's action
- AI hosted in France
- ISO 27001 certified hosting
- Works with Microsoft 365
Action required: approve your supplier payment
From: accounting@your-company-secure.net
Confirm this financial request
This message contains wording linked to a bank detail change or an urgent payment.
Recommended actionConfirm the request by phone, using a number you already know.
Hello,
Your approval is expected before 5pm, otherwise the transfer will be blocked and penalties will apply.
Please confirm through the secure payment portal.
Alerts protect in the moment. Understanding protects over time.
To display alerts in emails, market tools hand every mailbox in the organization to a third-party AI, with permanent read access and often write access. In practice, an outside service reads every message, including those from leadership, legal and HR. The MailWatch vigilance banner does the same alerting job from your own mail environment, with no AI and no data leaving it.
But an alert, however well placed, flags without explaining. That is where the MailWatch button takes over. When employees want to understand, they request the analysis, and the AI shows them the clues: the sender who is not who they claim to be, the link that does not go where it says, the manufactured urgency.
The moment of doubt becomes the moment of learning. The banner draws attention, the button explains, and report after report, people spot threats earlier and earlier.
A third-party AI with permanent access
It reads every email in every mailbox of the tenant to produce an alert. The alert flags, but does not explain.
A local banner, an analysis on request
The banner lives in your own mail environment, with no AI, and nothing leaves. The analysis only runs when an employee asks for it, on the single message they submit. It explains the clues, using an AI hosted in France that retains nothing and never trains its model.
Two layers, one principle: nothing leaves without your action
You choose the situations and customize the instructions and the look of the banners.
The MailWatch vigilance point
Check the sender's domain
This address matches a misleading variant of a protected domain.
Recommended actionContact the person through your usual channel.
- Real time, on every email, with no AI and no data transfer
- Rules deployed in your own mail environment, by your administrator. BlueSecure does not access your emails.
- Five monitored situations: a domain resembling yours, a colleague's name used from outside, a sensitive financial request, an attachment to watch, a password-protected attachment
- A single banner per message, with a concrete instruction, never a generic warning
Real time, on every email, with no AI and no data transferMailWatch Analysis
Dangerous email
Do not click, do not reply.
The sender is not who they claim to be · The link does not go where it says · Artificial urgency
- On request, on the single message the employee submits
- AI hosted in France: content is not retained and never used to train the model
- A plain-language verdict, three clues at most, one obvious action
- Phishing 360 simulations recognized instantly. Every report feeds the programme indicators.
Vigilance without handing your emails to a third-party AI
A contextual cue at the right moment, then an explained analysis if doubt remains. And because every action stays the employee's own, vigilance gets trained instead of dulled.
A third-party AI reads every email in the organization
Rules in your own mail environment: nothing leaves
Permanent read and write access to mailboxes
No BlueSecure access to content. The AI analysis only runs on the submitted message.
A banner on every message, which people end up ignoring
A banner when a specific signal appears, with an instruction to follow
A generic warning
A contextual cue, then an explained analysis if doubt remains
Data handling depends on the vendor
Hosted in France · no retention · no model training
A vigilance point, not a verdict. A banner draws attention and gives an instruction, but its absence does not guarantee that a message is safe. MailWatch replaces neither your spam filters nor your internal verification procedures.
From signal to reflex, in four steps
The banner draws attention
A specific signal appears and the vigilance point shows up in the email, with the check to perform. No AI, and nothing leaves your mailbox.
The employee requests the analysis
Banner or not, an email looks odd, so they click the MailWatch button. They decide what gets analysed.
The AI explains the clues
Sender, urgent tone, links, attachments. Not just a verdict, a line of reasoning the employee remembers. If it was a Phishing 360 simulation, they know right away.
Security takes over
Risky emails are forwarded to your ticketing tool or security team, with the analysis attached.
A plain-language verdict, not a technical report
Three clues at most, written as sentences. One obvious action per situation. The technical detail goes to your security team.
MailWatch
Dangerous email
Everything points to a fraud attempt.
Do not click any link and do not reply.Check with the supplier through their official website.
- The sender is not who they claim to beThe real address differs from the one displayed.
- The link does not go where it says“View my invoice” points to an unknown site.
- Artificial urgency“Before 5pm”: a classic fraudster pressure tactic.
MailWatch
Be careful
A few signals are worth checking.
Before acting, verify the sender through another channel.A call or an internal message is often enough.
- First contact with this senderYou have never exchanged with this address.
- An unexpected attachmentDo not open it before verifying the sender.
- Links check outThe links go where they say.
MailWatch
Nothing alarming
No fraud signal detected.
Good reflex to check.No analysis is infallible. Stay alert to the context.
- Authenticated senderThe address matches the organization displayed.
- Links check outThey lead to known, legitimate sites.
- No suspicious attachmentNothing executable or hidden.
MailWatch
Well spotted!
This was an exercise run by your organization.
The right reflex, at the right time
- A domain almost identical to yours“your-company-secure.net” instead of the real one.
- A pressing deadlineTime pressure short-circuits careful thinking.
Built to train, not to monitor
- Five monitored situationsA domain resembling yours, a colleague's name used from outside, a sensitive financial request, an attachment to watch, a password-protected attachment. You enable the ones that matter to you.
- Instructions in your own wordsWording, recommended checks and banner design adapt to your internal practices. A single banner per message, never stacked.
- Coaching through cluesThe analysis explains why an email is suspicious, not just whether it is. Employees come out stronger with every report.
- Simulation recognitionReported Phishing 360 campaigns are identified instantly: “Well spotted, this was an exercise.”
- Nothing leaves without your actionThe banner lives in your mail environment, with no AI. The analysis, hosted in France, only covers the submitted message: content is not retained and never used to train the model.
- Three entry points, one chainOutlook add-in, dedicated forwarding address or the BlueSecure Assistant in Teams: every report reaches MailWatch and feeds the same indicators. Banners roll out gradually, on a few pilot mailboxes first, and can be removed at any time.
Track your teams' maturity
We used to measure who clicks. MailWatch measures who has the reflex. The reporting rate becomes your progress indicator, correlated with Phishing 360 campaigns. Reports feed the BlueSecure Risk Index and appear in your Smart Report. True positives go to your security team. Measurement is collective, with no individual ranking of employees.
- 54%
- ↑ on simulated campaigns
- 29
- 20% of reports
- 3.1 h
- ↓ 0.8 h vs last month
- 62/100
- +8 points
- Suspicious email
- Malware / attachment
- Hardware incident
- Click rate
- Reporting rate (add-in)
- Not clicked + reported (the right reflex)
MailWatch for your role
- CISOYou choose the situations to flag, track the reporting rate by entity and receive the analyses of risky emails, with technical detail attached.
- IT director and Microsoft 365 administratorYou deploy the banners in your own mail environment, at your own pace, on a few pilot mailboxes first, without granting rights to a third party.
- EmployeeA cue at the right moment, a concrete instruction, and the option to understand in one click why an email is suspicious.
Trust can be measured
- organizations supported
- 500+
- people trained
- 700,000+
- user satisfaction
- 4.8/5
- ISO 27001 certified hosting
- France
organizations supported
people trained
user satisfaction
ISO 27001 certified hosting
The questions a CISO is entitled to ask
- Do you offer alert banners in emails?
- Yes. The MailWatch vigilance point appears as a contextual banner when a message shows one of the signals you have chosen to monitor, along with the check to perform. Unlike market approaches, there is no banner on every message, and no AI reads your emails to produce it.
- How do you add banners without accessing our emails?
- Checks and banners are applied by rules deployed in your own mail environment, by your administrator, based on the configuration you define in BlueSecure. Your emails do not pass through our servers and are not sent to any AI service. You can start on a few pilot mailboxes and remove the setup at any time.
- What permissions does the analysis button require?
- The add-in only accesses the message the employee submits, at the moment they submit it. No permanent read or write rights on your organization's mailboxes.
- Where is the data processed?
- The banner processes nothing outside your mailbox. The on-demand analysis is hosted in France, on ISO 27001 certified infrastructure. Analysed content is not retained and never used to train the model. Your data falls under no non-European jurisdiction and is not subject to extraterritorial laws such as the US CLOUD Act. The setup is GDPR compliant.
- What about the emails nobody suspects?
- That is the role of the MailWatch setup: drawing attention at the right moment to the risky situations you have chosen, before doubt even arises. For attacks that match no signal, human detection gets trained. BlueSecure Phishing 360 simulations create doubt at the right moment, and the MailWatch button turns it into action. A banner remains a vigilance point, not a verdict.
- Can people report outside their mailbox?
- Yes. Reports can come from the Outlook add-in, a dedicated forwarding address or the BlueSecure Assistant in Teams. All three join the same analysis chain and feed the same indicators.
- Can we deploy the banner without the button, or the other way round?
- Yes. The two layers deploy independently. You can start with the vigilance banner on a few situations, then add on-demand analysis to turn every doubt into a lesson.
See MailWatch in your own Outlook
30 minutes, your context, your questions.