Centeye Lighthouse · Email security
Lighthouse catches the fake invoices, bank-detail changes and boss requests your filter lets through, and pulls every copy.
$3B lost to business email compromise in the US in 2025. FBI IC3 2025 Annual Report
Part of the Centeye platform · People security
The emails that cost money rarely carry a virus. They look like a supplier updating bank details, the boss asking for a quick favour, or a QR code from HR. Lighthouse reads mail in Microsoft 365 and Gmail after it arrives, finds the phishing and fraud that slipped past, and pulls every copy out of every inbox.
Business email compromise (BEC) is fraud by email. An attacker poses as someone you trust and asks for money, gift cards or a password. There is often no link or attachment to scan, so a normal filter lets it through.
Lighthouse looks at who is really writing, whether the domain is a lookalike, whether the request is unusual for that sender, and what is hidden in images and QR codes. Then it acts on every inbox the message reached, not just one.
Capabilities
Each capability with a real situation: what happens, and what Lighthouse does about it.
Known-bad links are caught on sight. Suspicious ones are opened safely in an isolated browser, through every redirect, to see where they really lead.
A “document shared with you” link leads through three redirects to a fake Microsoft sign-in page.
Lighthouse follows every redirect in an isolated browser and quarantines the message when it lands on the fake page.
Lookalike domains, display names borrowed from a colleague, and requests to change bank details or pay a new account.
An email carrying the CEO’s name, from a personal webmail address, asks the office manager to handle an urgent wire.
Lighthouse sees the CEO’s name on an outside address the CEO has never used, and flags it before anyone replies.
Urgent favours, gift-card requests and password requests, judged on who is asking and whether it fits that sender’s history.
A supplier who always sends short notes suddenly sends a long, urgent request to pay a new account today.
Lighthouse weighs the new bank details and the change in tone against that supplier’s history, and holds the message.
Attackers put the link in a QR code, or the request in a screenshot, so filters can’t read it. Lighthouse reads the text and codes inside images too.
An “HR benefits update” is a single image with a QR code to scan with a phone.
Lighthouse reads the QR code, checks where it leads, and pulls the email before anyone points a phone at it.
If someone did click, Lighthouse finds the inbox rules and forwarding an attacker sets next, and hands the sign-in to Centeye Gatewatch.
Someone typed their password into a fake sign-in page before reporting the email.
Lighthouse hands the account to Gatewatch, which ends its sessions and checks for new inbox rules.
Checks whether your own domains can be spoofed, using their email authentication records (SPF, DKIM and DMARC), and tells you what to change.
Your domain’s settings would let anyone send mail that looks like it came from you.
Lighthouse grades the records and gives you the exact change to make, in plain words.
In the console
Real screens from the Centeye console. The clients, people and data in them are made up.
Under the hood
How it works
Lighthouse doesn’t stop at an alert. Praxis links what it finds to the rest of the attack, then fixes it at the setting you choose.
Spots what is wrong, as it happens.
Links it to everything related, in one case.
On your dial: tells you, asks first, or handles it.
In action
Pick a case to see what happened, what Centeye saw, and what it did.
Tuesday, 10:41 am
Accounts payable gets an email from a supplier asking them to use new bank details. The domain has the number 1 where an l should be. No link, no attachment.
Lighthouse spots the lookalike domain, registered six days earlier, and finds the same message in four other inboxes.
Every copy is pulled out of every inbox. The team gets a plain-English note on what the email was and why it was removed.
Thursday, 8:15 am
Thirty staff receive an “open enrolment” email from HR. It is a single image with a QR code and no link a filter can read.
Lighthouse reads the QR code, follows it to a fake sign-in page, and finds the same image in all thirty inboxes.
Every copy is pulled within minutes. Two people had already scanned it, so Gatewatch ends their sessions and resets their sign-in.
Better together
Identity, endpoint, email, AI use and agents are one picture to an attacker. Each link below is made automatically, in the same case.
Getting started
Connects by API with one admin sign-in. No change to how your mail flows and nothing in front of your filter. Running in under 10 minutes.
