Identity Threat Detection & Response · The EFA family

EFAidentity

Your accounts are the new perimeter. EFAidentity watches your Microsoft 365 tenant, Google Workspace domain or on-premise mail server around the clock for the things email filtering can never see: a stolen session signing in from the wrong place, a rule planted to hide replies, an app quietly granted access to mail, an administrator who appeared overnight. It connects them into one account-takeover alert and contains it on the spot: the rule is disabled and the stolen session revoked automatically, while an engineer is paged to finish the job.

Request an assessment Talk to sales

Filtering stops what arrives. It cannot see who is already inside.

Most account takeovers today never trip a spam filter. A user clicks a convincing login page and completes multi-factor authentication. The attacker keeps the resulting session, signs in from somewhere else within the hour, and plants an inbox rule that deletes or hides every message about invoices and payments. No password changes. No malware. Nothing is "broken". The first sign is a vendor asking, weeks later, why the last payment went to a new bank account.

EFAidentity reads the account platform itself, not the mail stream: sign-ins, mailbox rules, permissions, consents, admin changes and security settings. That is why it protects a mailbox whether or not its mail flows through OpenEFA, and why it sees the attacker's second step even when the first one was invisible.

Findings reach you through the same protected channel as the rest of EFA Security, and attacker addresses seen at one customer are contributed, with none of your data, to EFA Collective Intelligence so every participating defense recognises them next.

Run by the people who run your IT

Alerts page an engineer who already knows your environment, your filtering, your backups and your canary. Containment and cleanup are one conversation, not a hand-off.

No premium licensing, nothing on your computers

Works on the Microsoft 365 or Google Workspace licences you already have; full sign-in detail with Entra ID P1, audit-log coverage without it. Your own mail server needs only the small EFA agent on the server itself. Nothing is installed on users’ computers.

Connected, not another island

Sign-in anomalies are checked against EFA Collective Intelligence, and what EFAidentity sees strengthens every other EFA defense. A spray against one customer blocks at every gateway and filter.

What EFAidentity detects

Every few minutes, across every mailbox, whether it lives in Microsoft 365, Google Workspace or on your own server.

Stolen sessions & suspicious sign-ins

First sign-in from a new country, impossible travel between two logins, addresses already on the collective block list, hosting and anonymiser networks, password guessing that finally succeeds, and legacy protocols that bypass MFA.

Hidden inbox rules & forwarding

Inbox rules and Gmail filters that delete, hide, mark read or target words like invoice, wire and payment. Mail forwarded or redirected outside the organisation. Full-access, send-as and delegate access. Transport rules that copy mail.

Rogue apps & consents

Third-party applications a user consents to, in Microsoft 365 or Google Workspace, rated critical when they ask for access to mail. Credentials added to app registrations. New service principals and service accounts.

MFA & administrator changes

Authentication methods registered or changed, especially right after an unusual sign-in. Anyone added to an administrator role. Password resets, account enable and disable.

Weakened security settings

Conditional access policies disabled or deleted, security defaults or 2-Step Verification enforcement turned off, audit logging switched off, SMTP AUTH, less-secure apps or external forwarding re-enabled, Microsoft Secure Score drops, two-factor authentication unavailable on your own server.

Account takeover, connected

A suspicious sign-in and a hidden rule on the same mailbox within the hour are not two notes. They are one account-takeover alert, with the evidence attached, that pages a person.

Automatic containment

When a takeover is confirmed, EFAidentity disables the attacker's inbox rule and revokes every sign-in session for the account within seconds, before anyone picks up the phone. Both actions are reversible, rate-limited, and logged beside the alert. Disabling the account itself stays a human decision.

What a real incident looks like

Ten minutes from the attacker's first action to automatic containment. The industry norm is measured in weeks.

09:21Attacker signs in from the Netherlands with a session stolen by a phishing page.
09:24Creates an inbox rule named "." that hides every message mentioning invoices.
09:25EFAidentity flags the sign-in: first login from that country, address on the collective block list.
09:30Rule snapshot catches the hidden rule and ties both signals to one mailbox.
09:31EFAidentity disables the rule and revokes the attacker's sessions automatically, and pages the on-call engineer with what it did. Password reset with the customer and hidden mail restored within the hour.

Coverage and hygiene, every day

The same connection answers the questions insurers and auditors ask.

MFA registration report across every account that can sign in, with any administrator lacking MFA rated critical.
Licence audit: seats assigned versus used, accounts dormant for 90 days, never signed in, or disabled but still paid for.
Security posture tracked daily: Microsoft Secure Score with conditional access and security defaults, Google Workspace 2-Step Verification and app-access settings, and the authentication and administrator configuration of your own server.
Monthly summary in your EFA Security report: mailboxes watched, MFA coverage, activity reviewed, settings, licences.
Onboarding assessment on first connect: posture, admin accounts, risky apps, dormant accounts.

How it works

Consent once

Your Microsoft 365 Global Admin or Google Workspace Super Admin approves a read-only, vendor-approved application. About ten minutes, revocable by you at any time. For your own mail server, the EFA agent is installed on the server instead.

Collect

Sign-ins, directory and admin audits, inbox-rule and filter snapshots, the platform audit log and security posture, polled every 5 to 15 minutes. On your own server, the same from its audit log and account settings. Never message content.

Correlate

Each finding is scored, checked against EFA Collective Intelligence and tied to its mailbox, so access and persistence together become one takeover alert.

Respond

A confirmed takeover is contained automatically: rule disabled, sessions revoked. Critical findings page an engineer by text, then by phone, who resets the password, restores hidden mail and reports back to you.

What is covered

Area	What EFAidentity watches	Cadence
Sign-ins	New country, impossible travel, collective block list, spray-then-success, legacy protocols, platform risk flags	5 min
Mailboxes	Inbox rules and Gmail filters, forwarding, delegation, transport rules, mailbox audit settings	15 min snapshot + audit log
Identity & admin	MFA methods, role grants, app consents, app credentials, password resets, user lifecycle, domains	5 min
Tenant posture	Conditional access, security defaults, 2-Step Verification enforcement, audit logging, SMTP AUTH and less-secure apps, external forwarding policy, modern auth, Secure Score	daily and on change
Coverage	MFA registration per account, licence use and dormant seats, daily summary per tenant or server	daily
Response	Automatic: disable the planted inbox rule, revoke sign-in sessions. Human, with an audited reason: disable or restore the account, re-enable a rule	seconds after a confirmed takeover

Platforms

Platform	How it connects	What it reads
Microsoft 365	Read-only Entra ID application, approved once by your Global Admin	Sign-in and audit logs, inbox rules, forwarding, delegation, app consents, admin roles, conditional access, Secure Score
Google Workspace	Read-only service account, authorised once by your Super Admin	Login and admin audit logs, Gmail filters, forwarding and delegation, OAuth app grants, admin roles, 2-Step Verification settings
On-premise mail servers	The EFA agent on the server itself: Zimbra, Exchange Server and most Linux or Windows mail servers	Authentication log, mail filter rules, forwarding, send-as and delegate grants, administrator accounts, two-factor and class-of-service settings

One service, one alert format and one monthly report across all three. If your server keeps an authentication log and exposes its mailbox settings, the agent can watch it.

Common questions

ITDR watches the accounts themselves rather than the devices or the mail: who signed in, from where, what they changed, and what they left behind. Business email compromise almost always begins with a valid login, so a product that only inspects messages or endpoints misses it. EFAidentity is ITDR for Microsoft 365, Google Workspace and on-premise mail servers, delivered as part of EFA Security.

No. The service sees sign-ins, rule settings, permissions, consents and configuration. It does not read or store message bodies or attachments. The one mail permission it holds is used only to resolve the name of a folder a rule moves mail into.

For Microsoft 365, any licence with audit logging, which is the default. Sign-in detail such as location and client comes from Entra ID P1, included in Business Premium and E3 or above; on other plans EFAidentity reads logins from the audit log instead. For Google Workspace, any edition: the login and admin audit logs it uses are standard. For your own mail server, nothing extra; the agent reads the server’s own logs. No add-ons from Microsoft or Google are required.

Carrier tools typically watch logins and cut sessions, and they belong to the policy, so they end when the policy does and the carrier holds access to your tenant. EFAidentity also covers inbox rules, forwarding, delegation, MFA and admin changes, app consents and security settings, and it is run by the team that runs the rest of your IT, with a person who answers, cleans up and reports monthly. Using both is fine; granting a third party standing access to your tenant is a decision to make deliberately.

No. EFAidentity reads the account platform, so it protects mailboxes whose mail never passes through our filtering. Customers who use both get the full picture: the phish that arrived, the login it produced, and the rule it left behind, on one timeline.

Yes. The EFA agent, the same one EFAsentry uses, runs on the server and reads its authentication log and account settings: logins and failures by address and country, filter rules that hide or discard mail, forwarding, send-as and delegate grants, new administrators, dormant accounts, and whether two-factor authentication is even available. Findings, correlation, paging and automatic containment work exactly as they do for a cloud tenant. Zimbra, Exchange Server and most Linux or Windows mail servers are supported; if yours is unusual, ask and we will confirm before you buy.

Only two things happen without a person: a planted inbox rule is switched off, and the account's sign-in sessions are revoked. Both are reversible in one step, capped per hour, skip any account you place on a never-touch list, and are recorded next to the alert that triggered them. If the alert was wrong, the user signs in again and the rule is switched back on. Disabling an account is never automatic; an engineer does that with you, with the reason recorded.

Per-mailbox monthly pricing, with bundle discounts when EFAidentity is combined with OpenEFA, EFAlifeline or EFAcanary. The onboarding assessment is included. Contact us with your mailbox count for a quote.

Every EFA product makes every other one smarter

EFA Security is collaborative by design. Every product connects through Secure Conduit Technology — one hardened, monitored channel — so when one attacker is caught on any product anywhere in the community, the threat is neutralized locally and its tradecraft becomes intelligence that protects everyone else. Seen once, known everywhere.

Detect & sanitize

A bad actor hits any EFA product line — EFAgateway, EFAcanary, OpenEFA, and the rest. The threat is stopped and sanitized right where it lands, before it can do harm.

Strip your identity

The threat signal is extracted and every piece of customer-identifying information is removed. What's kept is the attacker's behavior — never who they targeted.

Record & share

The anonymized intelligence is recorded and distributed across the EFA community over Secure Conduit Technology — the same hardened channel the products already trust.

Protect everyone

Every other EFA deployment now recognizes that attacker on sight. A threat one customer sees becomes a threat the whole community is already defended against.

Your data stays yours. EFAintelligence shares what the threat was — never who was targeted. Customer identity, message content, and identifying metadata are stripped before anything ever leaves your environment. You contribute to the community's defense without exposing your business.