doorcheck
Threat intelligence

One attack. Learn once.
Protect many.

Your security shouldn’t learn in isolation. Every campaign the Doorcheck network sees becomes protection for everyone on it — automatically, within minutes.

Tenant Aunder attackcampaign fingerprintDoorcheck networkTenant BinoculatedTenant CinoculatedTenant Dinoculated
1
detection is enough — every tenant on the network benefits
min
from first catch to fleet-wide inoculation — not days
0
mail content shared — only the shape of the attack propagates

How network intelligence works

01
Detect
A campaign is caught in one tenant — by behavioral signals, content analysis, or a user report.
02
Cluster
Doorcheck fingerprints the campaign — infrastructure, lure pattern, sender behavior — and links every mutation of it.
03
Inoculate
The fingerprint propagates across the Doorcheck network. Every other tenant is protected within minutes, before the campaign reaches them.

Intelligence sharing uses campaign fingerprints — not your mail. Message content stays inside your tenant (or entirely on your hardware in sovereign deployments); what propagates is the shape of the attack.

The market reality

BEC — the payload-less email that filters can't see — has held near record levels for years. This is the category behavioral AI exists for.

BEC losses reported to the FBI (IC3), USD billions$1.9B2020$2.4B2021$2.7B2022$2.9B2023$2.8B2024Source: FBI IC3 Internet Crime Reports 2020–2024 (reported losses; actual losses run higher).
#1
phishing/spoofing is the most-reported cybercrime category (FBI IC3 2024)
68%
of breaches involve the human element (Verizon DBIR 2024)
<60s
median time for a user to fall for a phish after opening it (DBIR)

What we're watching

The threat landscape Doorcheck is built for — and where email attacks are heading.

AI-written lures
Language models have erased the tell-tale bad grammar. Detection has to move from “how it’s written” to “whether it makes sense”.
Payload-less BEC
No link, no attachment — just a request that abuses trust. The fastest-growing category of financial email loss.
Vendor-chain attacks
Compromising one supplier yields trusted access to hundreds of their customers. Relationship history is the only reliable defense.
QR & image lures
Moving the malicious link into an image or QR code pushes the click onto unmanaged phones, outside the browser’s protections.

Published threat briefs from Doorcheck network telemetry are coming as the beta fleet grows — we only publish numbers we can stand behind. To hear when they land, request a beta seat below or write to sales@doorcheck.io.

Don't trust the email. Check it.

Connect your existing mail in minutes — no MX changes, sovereign self-hosted option, free during beta.

Get early access