What KnoxDefender does

Backups & restore Coming soon

Daily encrypted backups of Exchange Online and Gmail mailboxes, stored outside Microsoft and Google with immutability.

• Incremental sync using officially supported provider APIs
• Per-organization encryption keys and Object Lock immutability
• Item, folder and mailbox recovery into a "Recovered" folder or label
• End-user restore requests with admin approval
• Monthly isolated restore tests

Good to know: Microsoft 365: any plan with Exchange Online. Google Workspace: requires Google app verification of KnoxDefender before launch.

Email security Coming soon

Detects phishing, business email compromise and malicious attachments or links after delivery, without changing MX records.

• Explainable risk scores with stored reasons
• Attachment scanning (ClamAV, macro, extension and hash rules)
• Safe link checks for lookalike and punycode domains
• Quarantine review, allow/block lists and reported-phishing workflow

Good to know: Works with any Exchange Online or Gmail mailbox. API scanning happens after delivery; there is a short exposure window.

Domain health Available

SPF, DKIM and DMARC monitoring with DMARC report ingestion and plain-English fixes.

• SPF 10-lookup check, DKIM selectors, DMARC policy
• DMARC aggregate reports by sending source
• Alerts on record changes and policy downgrades
• MTA-STS, TLS-RPT and BIMI readiness

Good to know: No Microsoft or Google license needed; uses public DNS and reports sent to KnoxDefender.

Mailbox security Coming soon

Watches for signs of mailbox takeover: forwarding rules, delegation changes, risky app access and suspicious deletions.

• Inbox and external forwarding rules
• Mailbox delegation and permission changes
• OAuth apps with mail access
• Sign-in and MFA findings where licensing allows

Good to know: Microsoft sign-in logs need Entra ID P1 (in Business Premium); risky sign-ins need P2. Google uses the Admin SDK Reports API.

Archive Coming soon

Searchable retained email with legal holds, exports and former-employee preservation.

• Org-scoped full-text search, logged
• Legal holds that override retention expiry
• Admin exports with audit trail
• Offboarding preservation

Good to know: Snapshot-based capture: it is not a guarantee that every sent or received message is captured.

Awareness Available

Authorized phishing simulations and short lessons written for nonprofits and small teams.

• Six original lessons with quizzes and certificates (available now)
• One-click assignment, due dates and automatic reminders (available now)
• Phishing simulations: written authorization required, fictional brands only, pages collect nothing (sending domain pending)
• Training assigned automatically after a simulation click

Good to know: No Microsoft or Google license needed.

Reports Available

Monthly printable reports per organization for boards, grants and insurance questionnaires.

• Coverage and backup freshness
• Restore-test results
• Threat findings labelled "detected" vs "blocked"
• Domain health and training completion

Good to know: Not applicable.

Restore requests with approval

Staff search only their own mailbox backups, select messages and explain why they need them. An administrator reviews the exact messages, restore point and destination. Approval locks the request; if anything changes it needs a fresh review. Restores add messages to a new "Recovered" folder and never overwrite or delete.

For small businesses

Invoice fraud and payment-change scams hit small businesses hardest. KnoxDefender pairs independent backups with domain protection so customers can trust that email from you is really from you.