EFA Collective Intelligence · EFACI

One shared memory.
Every EFA defense.

EFA Collective Intelligence, EFACI for short, is the service at the center of the EFA platform. It gathers what each EFA product learns about attackers, confirms it, and hands it to all the others. An attacker caught at one door is recognized at the next.

What it does What is never shared

In plain terms

What is EFACI?

Think of a neighborhood watch for security systems. Each EFA product guards its own house: a mail filter, a server, a website, a network. When one of them catches someone trying a door, it tells the watch. The watch checks the report, and if it holds up, every other house knows that face before it reaches their street.

Security tools working alone

The mail filter blocks a phishing sender. The web server has never heard of them.
An attacker banned from one server moves to the next and starts fresh.
Every system has to be attacked itself before it learns anything.
What one tool learned is forgotten when the attacker changes targets.

Security tools connected by EFACI

A source caught attacking a server is already known to the mail filter, and the other way around.
An attacker banned in one place is refused elsewhere, often before the first attempt.
Systems learn from attacks they never had to face.
What one tool learned stays available to all of them for as long as it remains true.

What it does

Four jobs, running all day.

EFACI is not another scanner. It does not inspect your mail or sit in front of your website. Its work starts after one of your defenses has already stopped something.

1. Collects

Each EFA product reports what it observed: a message it judged to be phishing, an address locked out for attacking a login page, a decoy that was touched.

2. Weighs

Reports about the same source are brought together and scored. How many independent systems saw it, how reliable they are, and how recently all count.

3. Shares

Confirmed threats go back out to every participating defense as reputation data and signed block lists that each product checks for on a regular schedule.

4. Forgets and corrects

Nothing is listed forever. Entries fade when the activity stops, mistakes can be traced and withdrawn, and a person's decision outranks an automatic one.

Who contributes, who benefits

Every product is both a sensor and a defender.

Each EFA product sees a different part of an attack. EFACI is where those views meet.

Product	What it tells the collective	What it gets back
OpenEFA	Its verdict on each message: where it came from, what kind of threat it was and how confident the filter is.	The reputation of sending addresses and domains, built from every participating mail filter and from attacks seen on servers and websites.
EFAshield	Attacks on the servers and websites it protects: password-guessing, exploit attempts, requests stopped by the web firewall.	A signed list of sources already confirmed as hostile, refused at the server's front door.
EFAcanary	The strongest signal there is: someone touched a decoy that no legitimate user has any reason to find.	Its job here is to be a sensor. A decoy touch is evidence the rest of the collective can act on straight away.
EFAgateway	Hostile activity it observes at the edge of the network.	Hostile addresses and domains to watch for across the whole network behind it.
E-commerce protection	Mainly a consumer of intelligence today.	A risk reading on the network a shopper is coming from, used to screen suspicious orders.
EFAidentity	Mainly a consumer of intelligence today.	Whether the address behind a sign-in is already known to the collective, added to the alert.

EFACI also takes in established public threat feeds, so its picture is not limited to what EFA systems have seen first-hand. How much each product relies on the collective is a matter of that product's policy and your configuration.

An example

One attack, start to finish.

This is the pattern we see every day across the systems we protect.

The second target never sees the first attempt.

The attackAn attacker probes a mail server for a known software flaw.
The server belongs to one EFA customer. The attacker has a list of thousands more to try.
Seconds laterThe local defense blocks the attacker.
EFAshield on that server recognizes the attempt and locks the source out. That customer is protected whether or not anyone else ever hears about it.
NextThe observation goes to EFACI.
Only the facts about the attacker are reported: the address it came from, the kind of attack and when it happened.
Within minutesEFACI confirms it and publishes the update.
The report is weighed against what else is known. Once it meets the standard for action, the source is added to the signed list that participating defenses collect.
When the attacker moves onThe next server refuses the connection.
A different customer's server, which was never attacked, already has the update. The attacker is turned away at the door, and the mail filters in the collective now treat mail from that source with suspicion too.

How it decides

A report is a lead, not a verdict.

A shared system is only useful if it is hard to fool and quick to fix. These are the rules EFACI works by.

Rule 1

One voice is not enough

A single report from a single system does not get anyone blocked across the collective. Independent sources have to agree, or the report has to come from a source with a proven record.

Rule 2

Stronger evidence counts for more

Touching a decoy or attempting a known exploit says more about intent than one failed password. EFACI weighs evidence by what it actually proves.

Rule 3

The impersonated are not blamed

When a scam forges a real company's name, the company's reputation is left alone. A domain is only held responsible for mail it can be shown to have sent.

Rule 4

Everything expires

Addresses change hands and compromised systems get cleaned up. Automatic entries carry a time limit and lapse unless the hostile activity continues.

Rule 5

People outrank automation

Every report is recorded against the system that made it, so a bad one can be found and withdrawn. A decision made by a person is not overwritten by an automatic one.

Rule 6

Your defense makes the final call

EFACI supplies evidence, not orders. Each product combines it with its own detection and your policy, so your allow lists and your administrator's choices still stand.

Privacy

It shares what the attacker did. Not who they did it to.

The collective exists to pass on knowledge about attackers. It is not a copy of your mail and it does not tell one customer about another.

What a defense reports

The internet address an attack or message came from.
The sending domain, when the message proves it really came from that domain.
What the defense decided, the kind of threat, and how confident it was.
Patterns that identify a campaign, such as the set of sites a scam links to.

What stays with you

The body of any message, and any attachment.
The mailbox a message was addressed to.
Your files, your documents and your customers' records.
Anything that would tell another participant which organization was targeted.

Only registered, authenticated EFA systems can contribute to or read from the collective, each limited to the role it was issued. Published block lists are digitally signed, and a defense verifies the signature before it acts on an update.

To be clear

What EFACI is not.

Not a replacement for local defense

Every EFA product detects and stops threats on its own. The collective makes them faster and better informed; it is not what they depend on to work.

Not a public blacklist

Traditional block lists are a yes-or-no answer about an address. EFACI keeps a graded, constantly updated reputation built from several kinds of evidence, and it is available only to participating EFA systems.

Not a separate product

There is nothing extra to install or manage. It is the layer the EFA products share.

Not a store of customer data

It holds knowledge about attackers and the evidence behind it, not the contents of the systems it helps protect.

Questions

Common questions about EFACI.

No. EFA Collective Intelligence is the shared layer underneath the EFA products, not a separate purchase. If you run a participating EFA product, it is already contributing to the collective and benefiting from it.

No. What the collective passes between defenses is knowledge about attackers: hostile addresses, sending domains and campaign patterns, each with a threat type and a confidence level. Other participants never see who was targeted, and message bodies, attachments and recipient addresses are not part of what a mail filter reports.

The system is built to prevent that. A single report from a single source is treated as a lead, not a verdict. Before anything is acted on across the collective it has to be confirmed by independent sources or by a source with a proven record, automatic entries expire on their own, every report can be traced and withdrawn, and a decision made by a person always outranks one made by automation.

It informs the decision; it does not take it over. Each product weighs what the collective knows alongside its own detection and your own policy. Your allow lists and your administrator's choices still apply.

It keeps protecting. Every product has its own detection that works without the collective, and keeps a local copy of the most recent intelligence it received. A lost connection means it stops learning new things for a while, not that it stops defending.

Usually within minutes. Observations are reported continuously, weighed on a short cycle, and each defense checks for updates on its own schedule.

Only registered, authenticated EFA systems can contribute or receive intelligence, and each is limited to the role it was issued. The lists that defenses act on are digitally signed, and a defense verifies that signature before it uses an update.