MailThreatZero: how a message is scored
For administrators and analysts who tune MailThreatZero: the five scanning stages and the weighted score, the quarantine and reject thresholds, why malware is decisive and allow lists can't override it, how authentication shapes the later stages, the optional impersonation, payment-fraud and AI checks and their guardrails, and how attachments, links and QR codes are assessed, including what behavioural sandboxing does and does not do today.
- Level
- Intermediate
- Length
- About 55 minutes
- Contents
- 3 lessons · 1 video · final exam
- Status
- Published · updated 2 Oct 2026
- MailThreatZero
Skills you'll practise
- Explain how stage scores combine into one weighted total and which threshold decides deliver, quarantine or reject
- Read a per-message breakdown and say which stages contributed, which did not run and why
- Describe how sender authentication changes the later stages, and why passing it does not clear a message
- Choose per-domain settings for impersonation, payment-fraud and AI checks knowing their defaults and limits
- Explain how attachments, links and QR codes are assessed, and state the current status of behavioural sandboxing
Course outline
- 1.MailThreatZero: how a message is scoredVideo · 2 min
- 2.Five stages, one weighted scoreLesson · 18 min
- 3.Authentication, impersonation and AILesson · 18 min
- 4.Attachments, links and QR codesLesson · 19 min
- 5.MailThreatZero: how a message is scored: knowledge checkKnowledge check · 17 questions
- 6.Final exam9 questions · passing it completes the course, so people who already know the material can test out
Sources it draws on
The lessons and questions are written from these references, so learners can go back to the original.
- MailThreatZero: How it works (mail path, stages, decision, onboarding, Monitor Mode)
- MailThreatZero: Technical architecture (mail flow, pipeline, decision model, data handling, integrations)
- MailThreatZero: Security capabilities, stage by stage
- MailThreatZero: Features
- MailThreatZero: Feature status (generally available, beta testing, requires setup, not available)
- MailThreatZero: Attachment sandboxing (private beta)
- MailThreatZero: QR code phishing
- MailThreatZero: SPF, DKIM and DMARC (inbound checks and aggregate reports)
- MailThreatZero: home page (stages, explainable verdict example, console walkthrough transcript)
- MailThreatZero: Release notes
See it with your own jobs and topics
Tell us about your team and we'll walk you through setup, from choosing jobs to your first skills check.