Email Threat Protection Platform
Challenge
The email-security product (an enterprise Message Transfer Agent / MTA) needed to detect phishing, domain spoofing, Business Email Compromise (BEC), and zero-day malware attachments using several independent threat-scanning engines and external intelligence feeds — while keeping the scanning framework maintainable as new engines and feed formats were added over time, and giving administrators enough visibility to search, tag, and act on processed messages.
Approach
- Designed an adapter-based plugin layer to evaluate SPF, DKIM, and DMARC alignment and route suspicious payloads to sandbox environments.
- Leveraged AWS SQS for resilient, asynchronous message queuing between threat-scanning engines, and AWS SNS for real-time alerting on critical threat feed updates.
- Utilized AWS Lambda for serverless, event-driven threat intelligence lookups without blocking line-speed message processing, storing verdict metadata in highly available AWS RDS instances.
- Built administrative APIs and audit queries backed by AWS RDS to give operations visibility into engine verdicts and message-level threat metadata.
Outcome
Allowed the security product to ingest new threat feeds and scanning engines without core pipeline rewrites, reducing new-engine onboarding time and giving enterprise administrators verifiable audit visibility into quarantine workflows, Data Loss Prevention (DLP) violations, and threat verdicts.