.png?width=50&height=50&name=Untitled%20-%20July%2030%2c%202026%20at%2014.53.38%20(3).png)
/Misc%20Icons/icon-red-teaming-agent-gradient-simple.svg){kind=icon}
/Misc%20Icons/icon-phishing-soc-agent-gradient-simple.webp?width=158&height=167&name=icon-phishing-soc-agent-gradient-simple.webp){kind=icon}
/Misc%20Icons/icon-phishing-simulation-agent-gradient-simple.svg){kind=icon}
/Misc%20Icons/icon-nav-encryption.svg){kind=icon}
/Blue%20Feature%20Flower%20Icons/gear%20head%20icon.svg)
/Misc%20Icons/icon-nav-credential-theft.svg){kind=icon}
Already handled. Now explained.
A VIP sender, an odd campaign or a question from leadership. You get the full why behind the outcome, ready to share.
Powered by
Phishing SOC Agent
Any incident gets an L2-level investigation in minutes, with every step on the record.
Watch the Phishing SOC Agent work one incident from question to verdict.
How it works
It finds the one thread in each email worth pulling and follows it to a verdict.
Every investigation opens with the checks any analyst would run. Then your Phishing SOC Agent looks for what makes this email different, and each answer it finds decides the next question.
Illustrative examples based on real investigations. Brands, names, prices, numbers and domains are fictional.
Where teams use it
Your Phishing SOC Agent steps in when a person on your team has to make the call.
Adaptive AI already handled these emails. Each story starts with a question someone asked about one of them and ends with an answer your team can stand behind.
1Verifying a closed incident
Already handled. Now explained.
The moment
Your CFO asks why an email from a board member never reached her inbox. Adaptive AI quarantined it last night.
The agent
One click hands the incident to your Phishing SOC Agent. It plans the checks, then sends sub-agents to look at the sender, the links, the attachment and the route the email took.
The outcome
In minutes you have a Phishing verdict and the evidence behind it. You forward the case file to the CFO, and the question is closed.
Incident · Quarantined#48213
- From
- James Ramsey <d.ramsey@northfield-capita1.com>
- To
- Office of the CFO
- Subject
- Board pack for Thursday, please review tonight
Closed by Adaptive AIQuarantined
Lead investigator: checking sender, links, attachment, delivery path
- SenderLookalike of the board member's domain, registered 9 days agoSuspicious
- Links"Open board pack" redirects twice to a credential pageMalicious
- AttachmentAgenda PDF opened in isolation, no active contentClean
- DeliverySent through a bulk relay the real sender has never usedMismatch
Phishing
Key evidence: lookalike domain, credential-page redirect2Ironscales Autopilot check-ins
Trust Ironscales Autopilot. Check in on it whenever you want.
The moment
Ironscales Autopilot resolves incidents on your behalf, end to end. It handled 1,618 this month, your quarterly review is next week, and you want a few documented examples.
The agent
Autopilot never calls the agent on its own. You pick an incident from the list, and the agent works it the way a skilled L2 analyst would, recording every search and lookup as it goes.
The outcome
You get the full story behind what Autopilot did, in a form you can drop straight into the review deck.
Autopilot · Resolved this month1,618 incidents
- "Updated W-9 attached" · accounts payableRemediated
- "Your parcel is held at customs" · 14 mailboxesRemediated
- "Shared: Q3 bonus schedule" · HR teamRemediated
- "Voicemail from +1 (614) 555-0142" · 3 mailboxesRemediated
Lead investigator: checking sender, message, attachment, delivery path
- SenderFirst email ever from this domain to your organizationNew sender
- MessageAsks AP to change a vendor's bank details before FridayPayment fraud
- AttachmentW-9 opened in isolation, bank details differ from the vendor recordMismatch
Phishing
The full why behind what Autopilot did3Release requests
Say yes or no to a release with the evidence in hand.
The moment
An employee in facilities asks you to release a quarantined invoice. The vendor says payment is overdue.
The agent
The agent checks who really sent it, where every link goes and what the attachment contains.
The outcome
The verdict comes back Safe, with the evidence attached. You release the email and keep the case on file for anyone who asks later.
Release request · Pending your answer#48977
- From
- Billing <invoices@harborline-hvac.com>
- Requested by
- Facilities coordinator
- Subject
- Invoice 2291, 30 days past due
"Can you release this? They say we're late."Quarantined
Lead investigator: checking sender, links, attachment
- SenderHas written to your organization for two years, authentication passesKnown
- Links"Pay invoice" goes to the vendor's real billing portalLegitimate
- AttachmentInvoice PDF opened in isolation, no active contentClean
Safe
Key evidence: long sender history, real vendor portalIllustrative examples. Names, domains and figures are fictional. The agent reports a verdict, and your team makes every decision.
Use cases
Three moments when your team owns the decision.
Trust Ironscales Autopilot. Check in on it whenever you want.
You want a periodic look at what Ironscales Autopilot handled on your behalf, and the agent runs only when you ask. You get a fast way to spot-check incidents and document what you found.
Say yes or no to a release with the evidence in hand.
An employee asks for a quarantined email back. You get a documented case for your answer, for the user and for anyone who asks later.
Every step on the record
Every search and every finding goes on the record.
You see each search, lookup and finding as it happens, then a verdict with the key evidence behind it. Use the case file for escalations, user follow-ups, leadership reports and compliance reviews.
leadPlan: sender, message, links, attachment, delivery path
senderDomain registered 9 days ago; no prior mail to this organization
messageUrgent request to review a document tonight
links2 redirects; final page imitates a sign-in screen
attachmentOpened in sandbox; no active content
relaysRoute does not match the claimed sender
leadVerdict: Phishing. Key evidence attached.
SenderBodyLinksAttachmentsRelays
Under your control
Your team stays in charge of every decision.
An AI investigator should be clear about what it does and what it leaves to you.
You start every investigation.The agent runs only when an admin opens an incident and clicks Generate.
It never acts on its own.The agent reports a verdict. It never reclassifies, releases or remediates anything.
Every step is on the record.Each search, lookup and finding is logged, then summarized with the verdict.
Attachments open in isolation.The agent opens files in an isolated sandbox.
You decide who uses it.Admins control who in your organization can use each agent.
How it fits
Adaptive AI handles the volume, and the agent takes the closer look.
Adaptive AI protects every mailbox automatically, and your thresholds decide when it acts on its own and when it brings an incident to you. When you want to look closer, the Phishing SOC Agent does the legwork.
| Adaptive AI | Phishing SOC Agent | |
|---|---|---|
| Job | Detect and remediate threats across every mailbox | Investigate one incident in depth |
| When it runs | Always, automatically | When an admin asks |
| Speed | Machine speed, at scale | Minutes per incident |
| Output | A classification and automatic action | A verdict plus the full evidence trail |
| Who it serves | The whole organization | The analyst making a call |
Adaptive AI keeps protecting every mailbox whether or not anyone runs the agent.
FAQ
Questions security teams ask about the Phishing SOC Agent.
What is the Phishing SOC Agent?
The Phishing SOC Agent is an on-demand AI investigator inside Ironscales. It investigates any email incident you hand it the way a skilled L2 analyst would, then delivers a verdict of Safe, Phishing or Spam with the key evidence and a full record of every step.
If Adaptive AI already protects us, why do we need an investigator?
Adaptive AI protects you whether anyone is watching or not. Some decisions still belong to a person: releasing a quarantined email, signing off on a borderline incident, explaining a call to an executive or an auditor. The agent gives that person the evidence to decide fast and defend the decision later.
Does the agent run on every email?
No. An admin starts every investigation. Most incidents don't need a case file because Adaptive AI already handled them. The agent is there for the ones your team wants to understand, prove or explain.
Can the agent change or release an email on its own?
No. The agent reports a verdict and never reclassifies, releases or remediates anything. Your team reads the case, makes the decision and moves on to the next one.
What does the agent check?
A lead investigator plans each investigation and sends sub-agents to check the sender, the message, every link, every attachment in an isolated sandbox, the delivery path, and your organization's context, such as who else received the email and the recipient's role.
How do I start an investigation?
Open any incident in your Ironscales console, select the Phishing SOC Agent tab and click Generate. In a few minutes you get a verdict, the key evidence behind it and a full record of every step the agent took.
Phishing SOC Agent
Your Phishing SOC Agent runs the deep investigation, and you see every step of it.
You get forensic depth when you need it, and your team stays focused on everything else.