Detection

Four layers of layered detection

102 detection capabilities protecting against misdirection, data loss, and threats. On-device policy + DLP, on-prem ML/NLP, and cloud-based AI/LLM work together to secure every outbound email.

47 policies
46+ DLP detectors
9 ML/AI models
Local-first
Detection Architecture

Four layers of defense

Our layered approach combines on-device and on-prem processing with cloud-based AI/LLM for context understanding. Each layer adds depth without compromising speed.

Policy Engine

47 on-device policies

Deterministic heuristics provide fast, predictable analysis with configurable thresholds.

On-Device

DLP Engine

46+ detectors, 29+ countries

PII and financial data detection with regional compliance coverage worldwide.

On-Device

ML/NLP Scanners

4 scanners

On-prem models detect context patterns invisible to rule-based systems.

On-PremExperimental

AI/LLM Models

5 models

Deep contextual understanding for ambiguous cases with cloud-based AI/LLM analysis.

Cloud-based
How It Works

Protection at compose-time

WaverSec Protect runs before you click send—not after. Catch mistakes before they become incidents.

1

Compose

As you write your email, WaverSec analyzes recipients, content, and attachments in real-time.

2

Warning

Risks appear in the sidebar panel with severity levels and clear explanations of what was detected.

3

Fix or Send

One-click fixes to remove flagged recipients or attachments, or acknowledge the warning and send anyway.

Layer 1: Policy Engine

Instant, predictable protection

47 deterministic policies provide fast, reliable analysis. No ML uncertainty—policies either match or they don't. Runs entirely on-device.

Misdirection Detection

  • Greeting mismatches
  • Wrong recipients
  • Thread context issues
  • Reply-all guards

Recipient Trust

  • Typosquatting detection
  • Freemail warnings
  • Disposable emails
  • Role-based addresses

Content Guards

  • Legal privilege markers
  • Confidential labels
  • Compliance references
  • Custom regex patterns

Sharing Controls

  • External recipient flags
  • Information barriers
  • Distribution analysis
  • BCC monitoring

Configurable: choose policies, tune severity levels, set thresholds per organization.

Layer 2: DLP Engine

Global compliance coverage

46+ PII and financial data detectors with checksum validation. Coverage across 29+ countries—from SSNs to IBANs to national IDs.

Universal

6 detectors

Credit cards, phone, email, IP, crypto

US

6 detectors

SSN, ITIN, passport, driver license

EU

18 detectors

IBAN, UK NINO, DE Steuer-ID, FR NIR

Americas

5 detectors

CA SIN, BR CPF, BR CNPJ, AR CUIL, MX CURP

APAC

11 detectors

AU TFN, SG NRIC, IN PAN, JP My Number

Financial Data

Credit cards, bank accounts, routing numbers

Identity Documents

SSN, passports, national IDs, driver licenses

Checksum Validation

Luhn, MOD-11, MOD-97, format validation

Layer 3: ML/NLP

Context that heuristics can't catch

When deterministic policies aren't enough, ML/NLP scanners provide contextual analysis. 4 on-prem scanners with minimal context transmission and stateless processing.

Misdirection Scanner

Uses NER and topic extraction to detect when email content doesn't align with the recipient list.

Catches context mismatches invisible to heuristics

Attachments Scanner

Analyzes attachment content and context to detect files being sent to wrong recipients.

Prevents sensitive document misdirection

Sentiment Scanner

Analyzes emotional tone to detect negative, aggressive, or unprofessional communication.

Stops emotionally charged messages

Single Recipient Scanner

Uses NER to detect when email content mentions people who are not the recipient.

Catches confidential content sent to wrong person

On-prem processing: NER, topic extraction, sentiment, and misdirection analysis with minimal context and immediate discard.

Layer 4: AI/LLM Models

Deep AI/LLM understanding when needed

For ambiguous cases requiring deeper reasoning, cloud-based AI/LLM models provide deeper analysis with admin control.

Email Misdirection Analysis

Identifies misdirection patterns and context mismatches that heuristics miss.

Attachment Misdirection Analysis

Detects wrong-file attachment patterns by analyzing context between email body and attachments.

Results Interpretation

Translates technical warnings into clear, actionable guidance for end users.

Email Tone Analysis

Detects inappropriate tone, profanity, and hostile language before emails are sent.

Attachment Tone Analysis

Detects unprofessional language in attachment filenames and content.

Privacy-first AI/LLM

AI/LLM models add advanced context analysis. When that layer is enabled, only the context needed for the analysis is sent to the configured provider. The cloud layer is optional and WaverSec Protect is designed to minimize retained message data.

Ready to see it in action?

Sign in to explore the full detection dashboard. Configure policies, enable detectors, and see how WaverSec Protect secures your outbound email.

FAQ

Detection Questions

Common questions about how WaverSec detection technology works.

1

How accurate is the detection?

The Policy Engine and DLP Engine use deterministic heuristics with checksum validation to reduce false positives. ML/NLP models are tuned for high precision, and cloud-based AI/LLM analysis provides explainable reasoning for edge cases.

2

Can I customize which policies are enabled?

Yes. Administrators choose which policies are active, adjust severity levels, and set custom thresholds. Available policies, DLP detectors, scanners, and AI models depend on your plan. The Business plan includes access to all 47 policies and every detection layer.

3

Does detection slow down email composition?

No. Policy and DLP run on-device and ML/NLP runs on-prem with sub-second latency. Analysis happens in real-time as you type, not when you click send.

4

What's the difference between the Policy Engine and ML/NLP layer?

The Policy Engine uses deterministic heuristics—explicit patterns that either match or don't. ML/NLP models analyze context and meaning, catching subtle mismatches (like discussing "Project Alpha" while emailing "Project Beta" team members) that heuristics can't detect.

5

What happens when the AI/LLM layer detects something?

When used, cloud-based AI/LLM models (third-party, tuned for WaverSec Protect) provide deeper contextual reasoning for ambiguous cases. Results appear in the warning panel with clear explanations under admin control.

6

What data does each layer analyze?

Each layer focuses on different aspects of your email. The Policy Engine checks recipient patterns and metadata. DLP scans content for PII and financial data. ML/NLP analyzes subject and body for entity and topic matching. Cloud-based AI/LLM models provide semantic understanding across all available context.

Ready to prevent accidental email data leaks?

Start securing your emails in minutes. Try it free.

Free trial
Setup in minutes