Most gateways let a message through when they are unsure: the scanner did not run, the file would not open, something timed out — the message is marked clean and delivered. It is convenient, and it is exactly how one message opens a whole network.
HSMG takes the other side — fail-closed. If an engine does not answer or a file cannot be opened, the message is temporarily rejected (SMTP 451) or quarantined. In banking and government that sharply cuts the risk of losing data.
The second principle is Fusion. One weak signal never blocks on its own; several weak signals combine into a confident decision. That two-key approach is what keeps false positives down.
| Decision | When it applies |
|---|---|
| Deliver | Clean message — delivered unchanged |
| Tag | Weak suspicion — marked in the subject or headers, delivered |
| Greylist | Reputation unclear — temporarily deferred |
| Quarantine | Strong suspicion — quarantined (HOLD + .eml) |
| Reject / Defer | Confirmed threat or scanner failure — 5xx reject / 451 defer |
Business email compromise usually arrives with no malicious attachment and no link — only text written in the name of someone trusted. A signature will never catch that.
| Layer | What is checked |
|---|---|
| Authentication | SPF, DKIM, DMARC and ARC — domain spoofing and forged senders. Outbound mail is DKIM-signed with a per-domain key |
| BEC / CEO fraud | Seven behavioural vectors in three languages: display-name imitation, lookalike domain, Reply-To mismatch, first-time VIP sender, urgency lexicon, changed payment details, a financial request from a first contact |
| VIP and impersonation | A name-to-real-address table for executives, finance and HR, synchronised from Active Directory groups |
| URL analysis | Links are analysed without being opened: typosquatting, homoglyphs, shorteners, Base64-hidden links, login pages without TLS, redirect chains followed to the end |
| QR codes | QR codes inside images and PDFs are decoded and the URL inside runs the full URL analysis — the quishing that text filters never see |
| OCR and password-protected files | Text, passwords and URLs are lifted out of images; the password is found in the message body, the document is opened and rescanned |
The DLP module identifies confidential data in the outbound flow and stops it leaving the organisation without permission. Every extractor pairs its pattern with a check digit, which is what keeps false positives low.
| Extractor | Data type | Check |
|---|---|---|
| Payment card (PAN) | 13–19 digit card number | Luhn algorithm |
| PINFL | Individual identifier | Format + check digit |
| INN / STIR | Taxpayer number | Format validation |
| Passport | Series and number | Pattern (AA1234567) |
| IBAN | International account number | MOD-97 check |
| CVV | Card security code | Context + proximity to a PAN |
| EXPIRY | Card expiry date | MM/YY pattern + context |
| SWIFT / BIC | Bank identifier | 8/11 character format |
Beyond the eight defaults the operator can add patterns of their own — an internal contract number, a customer identifier, a restricted project code. In the quarantined message and the forensic copy confidential data is masked automatically: the operator sees the evidence without the full value.
HSMG sends no data to any external cloud service. Signature databases, rules and indicators are updated offline, without ever reaching the internet.
| Control | How it is implemented |
|---|---|
| Air-gapped network | Detection kernels live on the internal network only; there is no external NAT or gateway and outbound update modules are disabled |
| Two-layer firewall | At host and forward level; only four ports face outward — SSH, the panel, SMTP :25 and submission :587 |
| Offline updates | Signatures, YARA rules, URL reputation and IOC feeds arrive on media or by scheduled synchronisation |
| Zero external telemetry | No file, sample or metadata is sent to a vendor cloud |
| Data residency | Every message, quarantine item and log stays on local infrastructure — aligned with MB 3669 and local storage requirements |
| Detonation isolation | The sandbox guest is never routed to the physical network and returns to a clean snapshot after each detonation |
The gateway sits in front of the corporate mail infrastructure and attaches to the SMTP flow as an MTA milter. There are three installation modes.
| Mode | How it works |
|---|---|
| MTA (inline) | Sits in the flow directly and makes the decision — full protection |
| SPAN / TAP | Passive observation — never touches the flow, only detects and reports |
| BCC (journal copy) | Watches a copy of each message — for evaluation without replacing the current gateway |
Only SMTP :25, submission :587, the panel and SSH face outward; the milter, ICAP and native AV ports stay on the internal network. The management panel is trilingual (Uzbek, Russian, English) with RBAC and central audit; Active Directory, LDAP and SSO are supported. Verdicts and events are forwarded to the SIEM and correlated with NDR and EDR.
No. HSMG is not a mail server but a filtering gateway in front of one. A message passes through HSMG and is then delivered to your Exchange or other backend.
Yes. SPAN/TAP mode does not enter the flow at all — it only observes and shows what it would have held. BCC mode works from a journal copy. Neither replaces your current gateway.
Yes, that is the core design condition. Signatures, rules and indicators update offline, on media or by scheduled synchronisation. Controlled online updating through a proxy is optionally supported.
Fail-closed applies only to scanner failure — an engine that did not answer or a file that would not open. Ordinary suspicion goes through the Fusion layer instead: one weak signal never blocks, and a confident decision needs several to agree.
No. No file, sample or metadata is sent to a vendor cloud — zero external telemetry is a hard requirement. Sandbox detonation also runs inside the local appliance.
We connect in SPAN or BCC mode and show you what is getting through today, without touching your current flow. No message is blocked at this stage.
