Vaikora › Blog › Product Updates

Cyren email security for Microsoft 365: how it connects, what it inspects, and where findings go

Product Updates · Nov 12, 2026 · 4 min read

When a phishing message arrives in a mailbox, most of the damage is already possible. The link is live, the payload is staged, and the user is one click away. The question worth asking is what happened during the hours before that email was delivered, and whether your security stack saw any of it.

Cyren's approach to email security is built around that earlier window. It monitors phishing and malicious infrastructure during the staging phase, before campaigns are fully weaponized. That timing matters because blocking a known-bad indicator after delivery is reactive. Flagging the infrastructure while it is being assembled gives your team a decision point before the message ever sends.

How Cyren connects to Microsoft 365

Cyren email security for Microsoft 365 runs on a virtual machine inside the customer's own Azure subscription. It connects through Microsoft Graph. There is no MX record change required. That is worth noting because MX-based integrations reroute mail flow and add a dependency to delivery. The Graph approach means mail analysis happens without touching your routing configuration.

Findings report into the customer's own Sentinel workspace. The workspace is yours; Cyren writes into it, not into a shared or vendor-controlled environment. That matters for data residency and for teams that need all detection signals consolidated in one place.

The telemetry behind the detection

Cyren's GlobalView network processes over a billion email, URL and file transactions per day. At that scale, infrastructure patterns become visible early. A new domain registered this morning that starts appearing in email metadata across the GlobalView network is a signal. The same URL structure appearing across thousands of unrelated tenants before any recipient has clicked is a signal.

Detection at staging means Cyren is flagging phishing infrastructure while it is still being prepared. By the time a campaign sends, indicators are already in the feed.

Where the signal goes after detection

Cyren ships through the Microsoft Sentinel Content Hub as a packaged solution. The package includes a CCF connector, analytic rules, hunting queries and workbooks. Installing it does not require custom connector development or manual indicator ingestion. The analytic rules are pre-written for the Cyren data shape, so a SOC analyst gets workable detections without building the logic from scratch.

Cyren also pushes indicators into CrowdStrike Falcon and SentinelOne. If your enforcement layer is in one of those platforms rather than Sentinel, the indicator still arrives. A phishing domain flagged by GlobalView becomes a threat intelligence entry in Falcon that your detection rules can act on. The pipeline is automated; the analyst does not have to manually export and re-import.

What this looks like in practice

Suppose a credential-harvesting campaign targets your industry. The attacker registers domains, stages a login page, and begins sending. Cyren's GlobalView network picks up the domain and URL pattern during staging. The indicator enters the Cyren feed.

In Sentinel, the analytic rule fires when that indicator matches inbound mail metadata. The SOC analyst sees an alert with the full context: domain age, URL pattern, volume across GlobalView. If CrowdStrike Falcon is in the stack, the domain is already blocked at the endpoint level before the first internal user clicks.

That is the value of staging detection. The window between infrastructure setup and campaign launch is real, and acting inside it changes the outcome.

The Vaikora layer: AI agents and email workflows

Where Vaikora fits is when AI agents are involved in email workflows. An AI agent configured to process inbound mail, extract data, or take action based on message content introduces a different risk. The agent can be manipulated through the message itself.

Vaikora sits inline between an AI agent and the tools or LLMs it calls. It enforces an allow, block, modify, or require-approval decision before each action executes. If an agent is reading email and the message contains a prompt injection attempt, Vaikora evaluates that action against policy before the agent acts on it. The decision is logged to a SHA-256 hash-chained, tamper-evident audit record. Every decision is deterministic: identical input produces identical output, every time.

Cyren catches the email threat at the infrastructure level. Vaikora controls what an AI agent is permitted to do with what it reads. The two controls operate at different points in the same workflow.

What to check next

If you are running Microsoft 365 and Sentinel, verify whether the Cyren solution is installed from the Content Hub and whether the analytic rules are active. Check that the CCF connector is reporting telemetry. If you have CrowdStrike Falcon or SentinelOne in your stack, confirm that Cyren indicators are reaching those platforms and that your enforcement rules reference them.

For teams running AI agents against email data, review what tools those agents are permitted to call and whether any runtime policy layer sits between the agent and execution.

More from the Vaikora blog