What INKY has found: reading your trial results

At the foot of the trial Home page is a section called What INKY has found. It is not a task list. It is the trial's output: what INKY caught in this tenant's mail, and what someone did about it.

Read it, but do not let it stand in for the whole evaluation. Whether a real attack arrives in your 30 days depends on your mail, not on INKY, and plenty of good trials end without a dramatic catch. The thing you control is how much of the product you switch on. See Getting more from your trial: the eight tracks.

It has four lines.

Threats flagged

Messages INKY judged to be a real attack, with evidence. Phishing, impersonation, malicious links, fraud attempts.

The count leaves out graymail. A tenant can have thousands of newsletters correctly identified and no attacks at all, and calling those threats would tell you something false about your risk. Newsletters are counted under Graymail, where they belong.

How soon this happens depends on your mail, not on your setup. Nothing you do makes an attack arrive, and a low number here is a fact about your month rather than a shortfall in the trial. The last section covers what to read instead.

To see the messages, open the message feed or the Threat Center. See How to Search for Emails and Using the Threat Center Page.

Senders that fail authentication

This line is the opposite of the others. A finding here is a job, not an achievement.

Some mail sent on your behalf does not pass authentication. A marketing platform, an invoicing service, a provider upstream. INKY cannot tell that apart from someone spoofing you, so it flags it. If you know the sender is legitimate, allow it, either from the allow list or straight from the message.

This is one of the most useful things a trial turns up, because it is an inventory of who sends mail as you, and most organizations have never seen one. Working through it improves your mail's deliverability whether or not you buy INKY.

See Allow List Overview.

Messages opened

How many messages someone on your team has opened and read in full.

This is the honest measure of whether anyone evaluated the trial. Open anything INKY has analyzed and read what it found: the sender, the links, and why it landed where it did. That page is the product. A trial where nobody opened a message is a trial where nobody looked at the product.

See How to Search for Emails and Phish Fence Explained.

Threats acted on

Messages released from quarantine, or remediated after they had already landed.

It becomes actionable once there is a threat to act on. Releasing a newsletter from quarantine does not count here. That is list management, not incident response.

See Quarantine Features.

If it is empty

An empty results section usually means one of three things, and they call for different responses.

• Mail is not reaching INKY. Check the verdict at the top of Home. If it says you are not protected yet, that is your answer. Finish the setup checklist. See Getting protected: the nine setup steps.

• Too few mailboxes are in scope. A pilot of five quiet mailboxes will not produce much. Widening the protected group is the single most effective change you can make to a quiet trial.

• It has been a quiet month. This happens, and it is not a failure of the trial. It does mean counting attacks will not settle your decision, so judge INKY on the next section instead.

Four findings that do not need an attack

These are the parts of the trial you can go and get today. Each one comes from a card you can switch on in minutes.

1. Your DMARC posture. Which of your domains someone else could send mail as. INKY answers this from public DNS on day one, with no waiting. Most organizations find at least one domain they had not protected.

2. Who sends mail as you and fails authentication. The list above. Most organizations discover senders they had forgotten about.

3. How much graymail your staff receive. Turn on graymail labelling and look at the volume. It runs higher than people expect, and it is time your staff are spending.

4. What the banner does to a real inbox. Ask two or three colleagues what they think after a week. That is the part of INKY your organization lives with.

For a wider view of what INKY is reporting, see Dashboard Overview, Observations and Pre-built Reports.