Detection Technologies

Five technologies. Most modern products blend them.

Email security vendors ship different architectures, but under the covers they are combinations of five detection technologies. Evaluating a vendor by which technologies they are designed around versus which they merely use as components is the most honest way to read the market. Hover any card for a plain-language summary. Click More → on any card to jump to the full comparison matrix and per-technology detail.

T1Pattern Matching T2Threat Intel T3Behavioral ML T4NLU / LLM T5Adaptive Reasoning
T1Matches emails against known-bad patterns: URLs, hashes, signatures. Fast on threats seen before. Blind to novel or AI-generated variants.
More →

Pattern Matching
and Rules

Signatures, regex, hash matches. Load-bearing for legacy SEGs. Defeated once attack similarity falls below 0.30 Jaccard.
More →
T2Databases of known-bad IPs, domains, URLs, hashes. Instant on commodity threats. Cannot catch what has not yet been catalogued.
More →

Threat Intel
and Reputation

Reputation feeds and blocklists. Necessary but insufficient once attackers laundered reputation through legitimate cloud infrastructure.
More →
T3Learns what normal communication looks like, flags deviations. Strong on established-relationship anomalies. Weak on first-contact and channel-pivot attacks.
More →

Behavioral ML
and Graph

Models built on sender-recipient graphs. Catches deviation from known-good behavior. Requires a learning period; blind to first-contact threats.
More →
T4One language model reads the email and classifies intent. Better than regex at meaning. Cannot verify claims or correlate signals beyond the text itself.
More →

NLU and
Single-Pass LLM

One model, one pass, one classification. Catches semantic meaning that regex misses. Cannot verify or correlate.
More →
T5Autonomous agents collect evidence in parallel. Depth of reasoning adapts to confidence: clear signals resolve fast, ambiguity triggers deeper analysis and more collection. System learns from every verdict.
More →

Adaptive Reasoning
with Agents

Autonomous agents collect evidence in parallel. Compute matches attack difficulty. No training period required because reasoning replaces pattern learning.
More →
Why this matters

A vendor who ships only Pattern Matching is a different kind of product from a vendor whose core is Adaptive Reasoning, even if both use every other technology as a secondary component. The question to ask any vendor is not "do you use AI?" It is "what are you designed around?"

StrongestLayer Threat Research. Email attack intelligence and detection architecture analysis.

Free AI gap check

Do you have an AI gap? Find out what’s getting through.

See which generations of defense you’re running and what it takes to close the gap. Two minutes. No signup. Nothing changes in your environment.

Book a demo Find my AI gap →