Integrated cloud email security (ICES) is software that reads a company's email inside the mailbox, after delivery, and flags messages that do not fit the normal pattern of who writes to whom. It is also called API-based email security. It catches fraud emails that carry no malware and no harmful link, which an email filter often lets through. The most costly of these is business email compromise, or BEC: an email that pretends to come from a boss or a supplier, to get money paid to the attacker.
ICES does not sit in the path of incoming mail, as a secure email gateway does. Instead, it connects to the company's cloud email service, such as Microsoft 365 or Google Workspace, through the service's API. An API is a fixed format in which one program asks another program for data or gives it an instruction. Through the API, ICES reads each new email within seconds of its delivery. It can also move an email out of the inbox, or add a warning banner to it.
To judge an email, ICES first learns what is normal. Over several weeks, it builds a record for each employee and each supplier: who they write to, at what times, from which places, in what tone, and which bank details appear in their invoices. Then it compares every new email with that record.
Imagine a garment exporter in Tiruppur. An accounts executive receives an email from a fabric supplier that the company has paid every month for four years. The email comes from the supplier's real address, because an attacker has stolen the supplier's email password. It asks for an overdue payment of ₹8.4 lakh to go to a new bank account. There is no attachment. The gateway passed the email, because the sender is real and the email is clean. ICES notices four things. The supplier has never asked to change bank details before. The email was sent at 2:40 a.m., from a country that the supplier has never written from. Replies would go to a different address from the sender's. And the email presses for payment today. Together, these give the email a high risk score. ICES moves it out of the inbox and alerts the security team. The executive never sees it.
ICES sends every flagged email to the company's SIEM. When an attacker also uses look-alike domains or fake login pages, ICES can report them to digital risk protection, which gets them taken down. Many ICES products use large language models, the kind of AI that reads the tone and intent of text. Attackers use the same kind of AI to write better fake emails, as the page on AI in cybersecurity explains. Both BEC and the fake login page are kinds of phishing.