Most enterprises are highly vulnerable to phishing attacks, often standing just a single compromised corporate inbox away from a massive data breach. This exact security gap became a reality during the cyber incident at the Bank of Baroda in late July 2026. A threat actor was able to compromise an employee email account, and because that user identity possessed access to shared directories, the attacker was able to quietly compile, zip, and exfiltrate approximately one terabyte of highly sensitive corporate and customer files. This stolen data included customer onboarding forms, Aadhaar and PAN card copies, savings and current account records, and internal audits from over one thousand branches across India.
To address this critical front-line vulnerability, security engineer Manish Rawat designed the Automated Phishing Triage Pipeline. Instead of waiting for an employee to make a mistake and click a malicious link, this pipeline moves threat triage entirely upstream. It intercepts and processes incoming email telemetry in real time, before the message ever reaches a user’s active session.
The architecture processes emails across three parallel analytical lanes:
Lane 1 (Envelope Verification): Parses SPF/DKIM/DMARC alignments, conducts WHOIS domain age checks, queries AbuseIPDB server reputation, and scans for homoglyphs attempting to spoof known vendors.
Lane 2 (Link & Intent Analysis): Extracts body text, uses an LLM to evaluate psychological social engineering tactics, computes URL entropy, and automates sandbox scans via urlscan.io.
Lane 3 (Payload Detonation): Decodes attachments, computes SHA-256 hashes, queries VirusTotal, detonations unknown payloads inside a secure Hybrid Analysis sandbox, and uses an LLM to summarize execution logs.
By merging sender, link, and payload telemetry into a single investigation record, the system triggers an automated session lockout the moment a threat threshold is crossed completely closing the exfiltration window before a single file leaves the network. In practice, this automation compresses traditional SOC analyst investigative timelines from 30 to 45 minutes down to just 45 seconds of total execution, driving a 98% reduction in manual investigative overhead and a 100% reduction in manual initial triage time
