Multi-tenant by design
One platform, many organizations. Each tenant sees only its own data, enforced at the database with row-level security.
PhishNode
Phishing detection & triage
Every reported email, answered.
Employees report suspicious emails in one click, right from their inbox. PhishNode enriches every report with threat intelligence in seconds, puts it in front of an analyst, and closes the loop the moment a verdict is set.
See how it worksphishnode · email queue
SAMPLE
- HPVerify your bank details before FridayHR Payroll · In reviewphishing
- DContract awaiting your signatureDocuSign · Enriching
- IHMailbox storage almost fullIT Helpdesk · Donesuspicious
- FQ3 budget review — agendaFinance · Doneclean
Verify your bank details before Friday
payroll@yourcompany-portal-secure.com
- SPF / DKIM / DMARCFail
- Lookalike domainMatch
- URL reputationMalicious
- Attachment hashClean
- AI intentCredential theft
CleanSuspiciousPhishing
- Reporter emailed
- Security manager alerted
- SIEM webhook delivered
- Audit log entry
1 click
To report, from the inbox
Seconds
To enrich every report
EN · FR
Branded replies to reporters
Multi-tenant
Isolated by design
From report to response, automatically.
The gap between “an employee suspects a phishing email” and “security has acted on it” is where attackers win. PhishNode closes it end to end.
- 01
Report
An employee clicks Report right inside their inbox — browser extension or Gmail add-on. No portal, no password, no training. Headers and attachments are captured intact.
- 02
Enrich
In seconds, every URL, domain, IP, and attachment hash is checked against threat-intelligence feeds in parallel, with an optional AI read of the message's intent.
- 03
Decide
Analysts work one clear queue. They open a report, review the evidence side by side with the raw source, and set the verdict. The AI advises; people decide.
- 04
Respond
The moment a verdict is set, the reporter gets a branded reply, severe cases escalate to the security manager, the SIEM receives a signed webhook, and the audit log records it.
Evidence first, verdict second.
Every report fans out to multiple checks in parallel. Each is time-boxed and fail-safe, so a slow source never stalls triage — and analysts always see why.
Report from anywhere
- Chrome extension
- Firefox extension
- Gmail add-on
- Roundcube webmail
- REST API
- Webhooks
- 01
Header authentication
SPF, DKIM and DMARC results for every reported message.
- 02
URL & domain reputation
Every link and referenced domain checked against multiple reputation feeds.
- 03
IP reputation
The originating IP scored against abuse databases.
- 04
Malware hashes
Attachment SHA-256s looked up against a shared malware corpus.
- 05
Safe-browsing signals
Live social-engineering and unwanted-software flags.
- 06
IOC matching
Your own indicators plus global community feeds, matched automatically.
- 07
AI intent
Injection-hardened reasoning over sender, subject, and body — shown inline, never overriding the analyst.
Built for security teams — and the MSSPs that serve them.
Roles that fit real teams
Owner, admin, analyst, and viewer roles with seat caps — plus reporters who never need a dashboard login.
Cyber Weather
Trends at a glance: verdict distribution, threat volume, top reporters, and top attackers over any time window.
Verifiable reports
Printable compliance and activity reports, integrity-hashed with SHA-256 so a shared PDF can be verified.
Security Center & audit
Live sessions, connection history, MFA resets, and a permanent audit trail of every meaningful change.
API & signed webhooks
Scoped API keys for automation and signed, retried webhooks that push every verdict into your SIEM.
Run it yourself, or let us run it.
Choose the model that fits your team. Switch as you grow.
Your SOC
Self-managed
Your own SOC or IT team runs triage in PhishNode, with the full role set and your own intelligence quotas.
- Owner, admin, analyst & viewer roles
- Bring your own intel keys
- Full queue & verdict control
Premium
Managed service
Cynguard analysts run triage for you. Your team keeps full visibility while we handle the queue.
- Triage by Cynguard analysts
- Service activity reports
- Shared intelligence coverage
See PhishNode in action.
Book a walkthrough with our team. We'll show you the product and how it fits your environment.