We launched EFAidentity at the start of November to catch what email filtering cannot: the attacker who is already signed in. This month it reached every platform it was built for, its automatic containment was proven end to end, and it gained the feature we think matters most: when OpenEFA sees an attack arrive in a person's inbox and EFAidentity sees that person's account change, the two now become one alert.
1Google Workspace is live
EFAidentity now watches Google Workspace domains the same way it watches Microsoft 365 tenants. A Super Admin authorises our service once; from then on EFAidentity reads the login and admin audit logs, Gmail filters, forwarding and delegation, OAuth app grants, administrator roles and 2-Step Verification for every user. Several domains on one Workspace account appear as one tenant with one report.
The first Workspace domain we connected showed why this matters. 2-Step Verification was enforced in the admin console, so on paper every account was protected, but most users had never actually enrolled. EFAidentity reports enrolment per person, not just the policy switch, so a gap like that is visible on day one.
2Your own mail server is covered
Organisations that run their own mail server have had the least help with account takeover, because cloud ITDR tools only read cloud logs. EFAidentity now runs on Zimbra servers through the EFA agent on the server itself. It reads the authentication log for sign-ins and failures by address and country, filter rules that hide or discard mail, forwarding, send-as and delegate grants, new administrators and dormant accounts. It also reports plainly when two-factor authentication is not available to users at all, which on self-hosted servers is common and rarely noticed.
Findings, correlation, paging and automatic containment work exactly as they do for a cloud tenant. For other mail servers, ask us; we confirm support for your server before you buy.
3Automatic containment, proven end to end
When EFAidentity confirms a takeover it acts before anyone picks up the phone: the attacker's inbox rule is switched off and every sign-in session for the account is revoked. This month we ran the full attack path against a live Microsoft 365 account of our own: a sign-in from abroad routed through a VPN, followed by a change to the account's multi-factor methods. EFAidentity tied the two together as a takeover, revoked the account's sessions within seconds, and paged the on-call engineer with what it had done.
Both automatic actions are reversible in one step, capped per hour, skip any account on your never-touch list, and are logged beside the alert. Disabling an account remains a decision a person makes with you.
4The inbox and the sign-in now compare notes
Account takeovers usually start in the mailbox and finish in the account. Until now those were two different products looking at two different halves of the same attack. For customers who use both OpenEFA email protection and EFAidentity, they are now joined.
When something happens to a person's mail and something happens to that same person's account around the same time, you get one takeover alert, not two notes.
The first mail signal we connected is the subscription bomb: a sudden flood of sign-up and newsletter confirmations, sent to bury the one email that matters, such as a password-reset or new-sign-in warning. On its own, OpenEFA handles the flood and sends a warning. If EFAidentity also sees a new sign-in, a password reset or a changed MFA method on that account in the same window, the two are combined into a critical account-takeover alert that pages immediately, with both halves of the evidence attached.
Coming next to the same model
- A phishing message delivered to a person, followed by an unusual sign-in to their account.
- A quarantined message released to a user, followed by account changes.
- Suspicious outbound mail from an account that EFAidentity already has concerns about.
Each one follows the same rule: two independent views of one person, one alert.
5Fewer interruptions, faster pages
- Planned work stays quiet. Tell us when planned account changes are coming, from your administrator or ours, and we open a work window for those accounts: the changes are still recorded, but nobody is paged for them.
- Takeover alerts never wait. During a burst of activity, lower-priority alerts are grouped; account-takeover alerts always go to the on-call engineer on their own, straight away.
What this means for you
If you already use EFAidentity, all of this is on for you now; there is nothing to install or approve again. If you use OpenEFA, adding EFAidentity is a single consent for a cloud tenant, or the agent for your own server, and the onboarding assessment is included. If you use neither, the assessment is the place to start: it shows your administrator accounts, MFA coverage, risky app consents and dormant accounts on the first day.