MailBreach — Business Email Compromise Detection SaaS
A production cybersecurity platform that continuously scans Microsoft 365 and Google Workspace tenants for hidden email forwarding rules, AI-classifies threats against MITRE ATT&CK patterns, and auto-remediates findings with full audit trails.
Bespoke Software — Complex Platform tier
The attack your SIEM doesn't catch
Business email compromise (BEC) is the costliest cybercrime category in the US — $2.9 billion in losses in 2023 alone. The attack vector most security tools miss entirely: after gaining initial access, attackers create hidden inbox rules that silently forward sensitive emails — invoices, wire transfer requests, password resets — to external addresses. The rule runs indefinitely. No alerts fire. The user never sees the forwarded emails. IT has no visibility.
MailBreach was built to close that gap. It detects MITRE ATT&CK T1114.003 (Email Forwarding Rule) — one of the most common post-compromise persistence techniques — across every mailbox in a tenant, automatically.
What was actually built
MailBreach is not a simple integration. It is a production-grade, multi-tenant SaaS platform with dual cloud provider integrations, an AI classification engine, an automated remediation system, and a compliance reporting layer. Every component was designed, built, and shipped with purpose by Crestwork Studio.
Ten major architecture components. Three rated Maximum complexity. One codebase, one engineer, one production deployment.
12 threat patterns. Three severity levels.
Every mailbox rule is analyzed against 12 known-bad patterns, each mapped to MITRE ATT&CK T1114.003. Findings are classified by severity and confidence score, then queued for remediation based on the tenant's configured mode.
Critical
auto-remediate eligibleExternal Forward (Non-Allowlisted)
Forwarding to an external address not on the approved list
Forward + Delete
Forward externally and delete the original, hiding evidence
Forward + Mark Read + Hide
Forward, mark as read, move to Junk or Archive so the user never sees it
Recently Created Rule
Rule created in the last 72 hours, a post-compromise timing indicator
New Unknown Destination
Forwarding to a newly-added external address
Suspicious
requires approvalAllowlisted External Forward
Forwarding to an approved domain that may still need review
Sensitive Keyword Targeting
Rules targeting "invoice," "wire," "ACH," or "password reset"
Auto-Delete Important Senders
Deleting emails from executives or security systems
Catch-All Forward
Broad rule forwarding all or most mail externally
Monitor
weak signalsExcessive Rule Count
User has an abnormally high number of rules or filters
High Rule Churn
Frequent rule changes in a short period
Tenant Posture Drift
External forwarding policy was loosened at the tenant level
Non-negotiable safety constraints
Every remediation action operates under strict guardrails designed to protect data integrity and support compliance requirements.
No email content access — only configuration metadata is ever read, never email content
Before-snapshots on every change — one-click rollback available for any remediation
Verification step after every fix — MailBreach re-reads the config to confirm the change applied
Allowlist enforcement — approved forwarding destinations are never flagged
Full audit logging — every action recorded with actor, timestamp, before-state, and context
Tenant isolation — complete data separation between all customers
Compliance-ready — audit trail supports SOC 2, ISO 27001, HIPAA, and cyber insurance documentation
Built with
Three tiers. 15-minute setup.
- Up to 50 users
- M365 or Google Workspace
- Approve-to-apply remediation
- Weekly evidence reports
- Email support
- Up to 500 users
- Both M365 and Google Workspace
- Auto-remediation (Severity 1)
- Daily drift control
- Webhooks and integrations
- Priority support
- Unlimited users
- Both providers
- Full auto-remediation
- Multi-admin workflows
- Advanced allowlists
- Dedicated support
- Custom SLA
MailBreach was built by Crestwork Studio as a live proof of our bespoke software capability. If you need a platform of comparable complexity built for your business — multi-tenant architecture, dual API integrations, AI classification, automated workflows — this is what we build.
Interested in what we can build for you?
MailBreach represents the top of our bespoke software category — a 9.2/10 complexity platform built to production with purpose by Crestwork Studio. If you have a complex software problem, we'd like to hear about it.