CHICAGO – November 06, 2026 -- StrongestLayer has launched Intent Workflows, a capability that holds high-risk emails before delivery and routes them to a designated person or security team, targeting attacks that carry no malware or suspicious links and pass standard security checks.
Few attacks drive nearly all losses, and most pass authentication
According to StrongestLayer's Q2 2026 Phishing Genome research, 3.6% of attacks accounted for 98% to 99.7% of financial losses. Of those attacks, 94% passed SPF, DKIM and DMARC authentication checks, and every one cleared the victim organization's secure email gateway.
"Some of the most expensive attacks look completely legitimate," said Alan LeFort, CEO and Co-founder of StrongestLayer.
Platform analyzes what an email asks a person or AI system to do
Intent Workflows applies a policy-driven approach. It scans inbound email for consequential intent, including instructions to move money, manipulate AI assistants, or threaten people and property. When it finds one, it holds the message and sends it for validation before it proceeds.
Three risk categories are covered
Vendor email compromise and payment fraud: The system tracks vendors' historical banking and account details and flags changes. When banking instructions change, it holds the transaction until it is verified through a previously established contact number. This blocks attackers from redirecting payments through compromised vendor accounts.
AI prompt manipulation: Employees increasingly use assistants such as Microsoft Copilot and Google Gemini to process email. Attackers can embed hidden instructions that make these tools forward confidential information, hide messages, or draft unauthorized approvals. Intent Workflows intercepts such instructions before the assistant processes them. It then neutralizes, quarantines or blocks the message under company policy.
Physical threats: Emails threatening employees, executives, buildings or other physical assets contain no technical indicators for conventional tools to detect. The platform identifies them and routes them immediately to corporate security or HR.
Companies set responses by sender provenance and potential consequence
Organizations can configure handling for each category based on the sender's provenance, the potential consequences and established policies. Options include automatically allowing verified communications, removing malicious instructions, quarantining messages, requiring human approval, or blocking them entirely.
Notifications and approval requests are delivered through Microsoft Teams or email, so finance, security and other responsible teams can act within existing workflows. Routine communications continue without interruption.
Intent Workflows is available as a capability within the StrongestLayer platform. Organizations do not need to replace their existing email security infrastructure to use it.