Caught in Week One

A compromised account sending from inside a trusted domain doesn’t look like an attack, not to a spam filter, and not to the person who opens it. Any single message can look completely ordinary. The only way to catch it is to score the pattern across many messages at once, which single-email filtering isn’t built to do.

Two public school districts found this out in their very first week on Wizer Email Security, before a single blocking feature was ever switched on.

Both districts started in pilot mode: WES scores every message exactly as it would in production, logs what it would have done, and takes no action, a zero-risk way to prove detection out on live mail before anyone flips on blocking.

Instead of judging each email in isolation, WES scores behavior across a whole set of messages at once: volume, timing, and the relationships between sender and recipients. That broader view is what surfaced every incident below.

District A (~1,000 mailboxes): In its first week, nobody was watching a dashboard, WES was simply logging what it would have done. By the next business day, that log held three separate real attacks from one weekend:

1. A compromised staff account, caught mid-blast. One already-compromised mailbox sent ~900 emails to ~600 of the district’s mailboxes, all in under 13 minutes, in the middle of the night.
2. A coordinated, multi-district campaign. Two other school districts, in different states, were separately compromised and used to send the same phishing lure 15 minutes apart. The version targeting this district carried a fake internal email thread impersonating its own superintendent.
3. A phishing link disguised as a shared document. A compromised account “shared” what looked like a Google Drive file; 125+ messages reached 65+ mailboxes with the phishing link hidden inside the document rather than the email itself.

None of these looked unusual email by email. What made them visible was the pattern across many messages at once.

District B, onboarded that same week: it took about an hour after rollout for two compromised staff accounts to send 20+ copies of the same phishing email to 10 colleagues, within about three seconds. WES flagged all 20+, zero misses, within seconds of the first copy going out.

The district’s own staff didn’t independently notice until about 8 minutes later. Had active protection already been turned on, every one of those messages would have carried a warning banner before anyone had the chance to open it.

Neither district has turned on active protection yet, that’s the conversation.

Pilot mode proves the detection works on a customer’s own live mail, with zero risk of a false positive breaking anything.

Turning on blocking is what turns that proof into protection: every message above would have been stopped, banner and all, before anyone opened it.