A Fortify 24x7 brand. Security run the way a triage station runs: sorted, tagged, and watched.Sign inRaise a consult
MediDefense IT
Station note C / Screening

Most of it arrives addressed to somebody who is already busy.

Referrals, invoices, payer correspondence. Reception, the biller and the practice manager all open mail from strangers as part of the job. Screening operates within the mailbox, not ahead of it, and adds short drills for the people doing the opening. Ironscales works at mailbox level over an API, and is not a gateway.

IronscalesMicrosoft 365 or Google WorkspaceInside the tenant
Two lines, at work within a tenant your clinic already pays for
Lines here2
KitIronscales
Counted byMailbox or user
JoinedBy API, inside your own tenant

Why the position matters more than the engine

Anything positioned ahead of your mail reads each message once, in passing, and its work is then done. Whatever passed at that instant passes forever, the message whose linked page was innocent on delivery and hostile by lunchtime included. Ironscales runs off a connection into Microsoft 365 or Google Workspace, which means it reads mail that already landed and stays free to change its mind afterwards.

In practice that means a message judged hostile is withdrawn from all of the inboxes it reached, not merely the one that raised a hand. Nothing is rerouted, no MX record changes, and no window opens in which mail piles up somewhere while an engineer works out what broke.

Anything positioned ahead of your mail reads each message once. A layer within the mailbox stays free to change its mind by lunchtime.

The drills, and the paperwork they leave behind

Simulation and short lessons sit on their own line, partly because a practice sometimes wants them without the mailbox layer, and partly because what they produce is worth having on its own. Campaigns get paced to teach. A lesson goes to the person who clicked rather than to everybody at once, which is the difference between training and a staff meeting.

Afterwards you hold a dated record, name by name, of what was sent and what was completed. That is the document somebody eventually asks for when the question becomes how the workforce was prepared, and it cannot be assembled from memory the week it is wanted.

Lines at this station

The lines themselves

Rates come live from billing. Anything tagged waits on the chart while you carry on reading.

Fortify-FES+SATLine specification

Mailbox Defense with Training

Ironscales · joined to the tenant by API, never a gateway

Cover operating within the mailbox rather than ahead of it, on the Microsoft side or the Google one, with brief drills for whoever opens referrals and invoices all day. An API connection is what lets it act on something delivered an hour ago.

  • Imitation and hijacked accounts, weighed against the way your people write.
  • Anything judged hostile is withdrawn from all the inboxes it reached, not merely the one that spoke up.
  • A button in the mail client, giving staff somewhere to send the doubtful ones.
Fitted toMicrosoft 365 or Google Workspace mailboxes, joined by API
WatchesMail once it has landed, and how people answer a rehearsed attempt
Kept forA reporting history your workforce training file can quote
Escalates toWithdrawal from the mailboxes first, then our desk
Reviewed byAn engineer, wherever the software is undecided
Readingper mailbox
charged monthly, up front
QTY
Fortify-SATLine specification

Phishing Simulation and Training

Ironscales · simulation and short lessons, bought on its own

Rehearsed attempts sent across the workforce, with a short lesson reaching whoever needs one. Priced by the person, so a clinic can run it without buying mailbox cover first. What comes out is the dated name-by-name record somebody eventually asks for.

  • Rounds are spaced to teach, not to catch people out.
  • The lesson follows the result, and lands on whoever clicked.
  • Completion and results, name by name, exportable whenever.
Fitted toNamed users in a Microsoft 365 or Google Workspace tenant
WatchesOpens, clicks, reports, and who got to the end of the lesson
Kept forA dated record, name by name, for your training file
Escalates toYour practice, as a summary fit to put before a committee
Reviewed byYour privacy officer, with our engineers on the numbers
Readingper user
charged monthly, up front
QTY
Referred out

Handed back at this station

Each station has an edge to it, and clinics get caught out by suppliers who pretend otherwise. Below is where this one stops, set down so a practice can work out what else it needs and who else has to supply it.

  • Some of it gets through. A real request, from a real person, sent out of an account somebody else has quietly taken over, can read as entirely unremarkable. The drills are on this station precisely because the layer alone is not enough.
  • Looking like your practice manager is not identity theft. Flagging a message written to imitate a colleague is within reach. Preventing somebody registering a near-identical domain is not, and neither is persuading a payer to change how it sends remittance advice.
  • A training record is not a sanction policy. The record shows what each person did. What follows from that is your policy, your process, and your judgement about people you employ.
  • Message bodies get examined. Deciding requires reading content, inside your tenant. A practice uncomfortable with that should not buy this line, and hearing so now is better than discovering it later.
  • It does not settle how you may use email clinically. Encryption in transit, patient consent, and what staff are permitted to send remain matters for your own policies and your own agreements.
NOTE 01

Heads up: card statements show FORTIFY 24X7 - MediDefense IT is a Fortify 24x7 brand, and your subscription is billed by Fortify 24x7.