TL;DR
- Phishing remains one of the primary initial attack vectors for enterprise breaches, driving users to report suspicious emails for SOC analysis—a necessary defense that can consume a large percentage of total analyst time.
- Despite this massive time sink, 95% of user-reported phishing submissions turn out to be harmless marketing noise or benign spam. While our automated marketing engine (AME) already auto-closes standard marketing templates, non-marketing benign junk continues to flood the queue.
- Our new phishing classification (PC) model works additively on top of AME, using a semantic similarity engine and machine learning classifier to automatically close high-confidence benign emails—with clear, human-readable explanations—so Expel MDR analysts can focus entirely on real threats.
According to the latest Expel Threat Intelligence Report, identity-based attacks—which rely heavily on phishing, credential harvesting, and social engineering—account for nearly 70% of all security incidents investigated by our SOC. Because a single malicious link or compromised credential can open the door to ransomware or data exfiltration, security teams wisely train employees to flag and report every suspicious message.
However, this creates a daunting operational reality for the SOC. Manually reviewing the user-reported phishing inbox can consume a large percentage of SOC analyst hours; analysts must dissect headers, inspect URLs, check authentication scores, and trace domain history. They are forced to hunt for context scattered across disparate tools, turning every reported email into a tedious, manual slog to figure out if a single reported email is actually dangerous.
The most frustrating part is that a staggering 95% of the time, the email is just another benign vendor newsletter, system alert, or harmless spam. Meanwhile, actual, high-stakes attacks are stuck waiting in line for analysis.
Amplifying our experts with AI-powered phishing classification
Gathering data and parsing raw headers for the hundredth time in a shift creates massive, unnecessary friction. We previously introduced our automated marketing engine (AME) to automatically filter out standard marketing communications, which successfully carved out a 23% reduction in queue volume. But marketing emails are only part of the benign pile.
To tackle the rest of the noise, we built our new Ruxie AI power-up: the phishing classification (PC) model as an additive alongside AME. Where AME acts as the domain expert for marketing patterns, PC acts as a broader semantic sentinel. PC widens the lens across the entire benign population, identifying emails that lack standard “marketing” features—like transactional updates, vendor notices, or system alerts—and matching them against harmless profiles.
How it works
AME and phishing classification work together as complementary layers in production.
When a user submits a suspicious email, both models evaluate it together. The AME model checks for standard promotional templates, while the phishing classification model assesses text content via a localized encoder alongside structural properties—including authentication results, reply-to/return-path mismatches, URL and domain attributes, attachments, tracking pixels, and header hops. It merges these signals with historical sender-domain reputation to evaluate how past communications from that source were handled.
| Feature dimension | Automated marketing engine | Phishing classification |
|---|---|---|
|
Role |
Marketing email domain expert | Broad-spectrum benign classifier |
|
Scope & focus |
Purpose-built to identify specific marketing patterns | Widens the lens to generalize across the entire benign population |
|
Target email types |
Standard newsletters, marketing blasts, and promotional emails | Non-marketing benign emails (vendor updates, transactional notices, system alerts, harmless spam) |
|
Core mechanism |
Trained on specific marketing labels and standard template features | Encoder embeddings over email text, combined with structural features and sender-domain reputation |
|
Action taken |
Auto-closes high-confidence marketing submissions | Auto-closes high-confidence benign submissions across all remaining non-marketing profiles |
The two run in parallel and their verdicts are combined, so a submission can be confidently auto-closed if either model clears it. Together, the two models auto-close nearly half of all user-reported phishing submissions with total transparency and zero impact on real threat routing.
Investigations are attached with clear, human-readable explanations of the decision drivers directly in the workflow, keeping everyone fully informed. Real, potential threats are never auto-closed; they bypass this step and continue directly to Expel MDR analysts for human investigation.
To ensure every auto-close is fast, accurate, and completely transparent, the system relies on a few key design principles:
- Additive multi-layer coverage: AME catches standard marketing templates; PC evaluates remaining submissions to auto-close additional non-marketing benign emails, effectively doubling our automated queue reduction.
- Explainable auto-close: Submissions clearing the high-confidence bar are auto-closed with a plain language summary in Expel Workbench™ that highlights the key decision drivers and lists every feature behind the call, so analysts can always see the full picture of why an email was cleared.
- Local data privacy: PC runs entirely inside our secure environment. There are no third-party API calls and no per-message generative LLM calls, keeping your data completely isolated and secure.
- Validated in shadow mode: Before auto-close is enabled in production, the model runs in shadow mode on live traffic, is validated against real analyst outcomes, and requires explicit SOC go/no-go sign-off. During our shadow deployment, the model achieved near 100% precision (99.85%) with zero malicious misses following our safety veto rules.
How this delivers a better defense for you
By delegating low-risk, repetitive triage to our multi-layered machine learning models, our security team reclaims the time and focus needed to stop actual attacks targeting your organization.
- Faster decisions and resolution: Harmless submissions are resolved instantly, drastically speeding up triage times and maintaining consistency regardless of alert volume or shift changes.
- Compound noise reduction: Auto-closing the benign majority cuts down analyst fatigue, allowing Expel SOC analysts to find and respond to true positives faster.
- Transparency and control: Every auto-close includes clear explainability detailing the reasons. Analysts retain full control to audit decisions and can reopen any auto-closed submission with a single click.
- Layered safety checks: Platform-level safety post-processing rules act as an independent backstop. Even if the model score is confident, factors like an escalated severity, or a newly registered domain will immediately silence the auto-close and route the alert directly to a human triage analyst. Phishing simulations and pen-tests are also explicitly routed directly to our analysts.
We use AI to eliminate repetitive grunt work and sharpen human decision-making. By pairing our automated marketing engine with phishing classification, we’ve created a comprehensive defense against inbox noise.
This ensures Expel’s cybersecurity experts have the time, energy, and context required to investigate, mitigate, and explain real threats instantly, without getting bogged down by benign clutter.
What’s next
Phishing classification is part of our ongoing investment in practical, privacy-first AI power-ups designed to streamline security operations. Our AI engineering team is continually building new models to eliminate friction across the entire defense stack, with more rolling out in the coming weeks.
Ready to see it in action? Phishing classification applies automatically for all Expel customers with Managed Phishing—with zero setup required and no workflow disruption. Check out the Workbench release notes or reach out to your account team to learn more.
