CEDX 2026 Security Release: Zero-trust PAM access, real-time SIEM, endpoint posture, and cryptographic secret vault Explore the CEDX Mail Security architecture ->
CEDXSystems
EnglishTalk to sales
IT MANAGEMENT & SECURITY CEDX Mail Security
Overview BEC radar Spoof board Workflow & Tour Operators TCO Model 14-Day Sandbox Live build ↗
IT MANAGEMENT & SECURITY CEDX Mail Security · IT & Security · mail-security.cedxsystems.com

The wire-approval mail never reached the CFO.

CEDX Mail Security scores every inbound message for phish, malware, spoof and BEC, and instead of a black-box verdict, it shows who is being impersonated, which campaign the message belongs to, and why.

Open live CEDX Mail Security -> Inspect 4-screen build tour
320 threats scored, 7 days 95 critical stopped 66.3% block rate Zero-ETL Shared Postgres Record
CEDX Mail Security Enterprise Architecture Briefing
CEDX Mail Security · 320 threats scored, 7 days

"Having identity, least-privilege access, audit trails, and business applications on one kernel cut our security review..."

Sarah Lindqvist · Chief Information Security Officer · Atlas Corp · 0.01s Canonical Sync
CEDX Mail Security reads and writes the exact same canonical Postgres record as CEDX SIEM, CEDX Access, and CEDX Endpoint with zero third-party webhooks.
🔒 https://mail-security.cedxsystems.com/workspace/live
CEDX Mail Security · Overview (The week in mail, three lines long)
mail-security.cedxsystems.com · 01 Overview · Live Canonical Dataset
● Overview Active · 0.011s Sync Open /app/mail-security ↗
THREATS SCORED, 7 DAYS
320
the corpus says “demo” on the screen
CRITICAL STOPPED
95
before delivery, per the board brief
BLOCK RATE
66.3%
block plus quarantine, trending on the
CLUSTERED MESSAGES
935
across 28 campaigns in the tenant
Security Control / Asset ID Principal / Endpoint Scope SOC Owner & Policy Telemetry / Grant Age Enforcement Action Posture Score
PAM Just-in-Time Grant #481CEDX Mail Security · Record #1040 Prod DB Read · Exp in 45m SecOps Auto-Reaper 64 Stale Grants Revoked ● Zero Standing Privilege 99.4 / 100
SIEM Correlation Rule #109CEDX Mail Security · Record #1041 2.4M Events -> 12 Actionable CISO Incident Pod 0.3s Detection Latency ● Session Quarantined 100% Audited
Fleet Endpoint Posture · 344 Mac/WinCEDX Mail Security · Record #1042 FileVault + Crowd/EDR + Patch v26 IT Security Ops 342 Compliant · 2 Quarantined ● Auto-Patch Scheduled 99.1 / 100
Vault Secret Rotation EngineCEDX Mail Security · Record #1043 184 Production Keys & Certs Platform Crypto Bus Max Secret Age: 14 Days ● Zero Plaintext Env Vars FIPS Verified
✦ CEDX Mail Security Copilot · PAM Just-in-Time Grant #481
Overview Verified
The board brief on the Overview reads: block rate 66.3% with 320 threats scored this week, 95 critical stopped before delivery; the vendor bank-change wave spoof cluster is the live storyline. Underneath it, the numbers the sentences came from.
CEDX Mail Security operator workspace in natural daylight
FIELD DOCUMENTARY · IT MANAGEMENT & SECURITY

The BEC radar names names

The board brief writes itself in three lines on the Overview: 320 threats scored this week, 95 critical stopped before delivery, and the vendor bank-change wave is the live storyline.

CAMERA: CANON EOS R5 · 35MM F/1.4 · NATURAL DAYLIGHT ESTATE ROUTE: /APP/MAIL-SECURITY
CORE CAPABILITIES · CEDX MAIL SECURITY

Three architectural jobs CEDX Mail Security gets right on one record.

Every capability below runs against the shared CEDX Postgres database with zero external sync queues or reconciliation lag.

01 · IT MANAGEMENT & SECURITY FOUNDATION

The BEC radar names names

64 principals scored for BEC risk; the radar shows the top 12 by transparent signal weights. The finance lead sits at 96: CFO, VIP, and vendor bank-change mail in her path. The shared AP mailbox scores 84 for the same reason.

✓ Cell colour is BEC risk; click a cell for evidenceVerified
✓ Role, department and VIP flag on every cellVerified
✓ Executive display-name match as a named signalVerified
02 · LIVE EXECUTION

Campaigns, clustered, not one-off emails

28 spoof campaigns in the tenant, 15 active. The vendor bank-change wave is 48 messages across 4 mailboxes at blast 98; the lookalike-domain spoof is 31 more. Clustering is the point: one blocked mail is luck, a named campaign is defence.

Campaigns, clustered, not one-off emails
CEDX Mail Security Live Telemetry ● 320 threats scored, 7 days
03 · DETERMINISTIC GOVERNANCE

Every threat with a verdict and a disposition

The threats table shows from-address, subject, verdict, confidence and what happened: blocked, tagged, quarantined, or delivered, with the risk still attached. The lookalike sender domains are legible in the from column, character by character.

✓ Verdicts: malware, phish, BEC, spoofActive
✓ Confidence per threat, 92 to 96 in viewActive
✓ Delivered-risk is its own tab: 28 of themActive
04 · VERIFIED DEMO DATASET METRICS

What the live CEDX Mail Security build looks like when you open /app/mail-security.

Every figure below is directly inspectable in the running CEDX Mail Security application workspace with zero synthetic projections.

THREATS SCORED, 7 DAYS
320
the corpus says “demo” on the scre
CRITICAL STOPPED
95
before delivery, per the board bri
BLOCK RATE
66.3%
block plus quarantine, trending on
CLUSTERED MESSAGES
935
across 28 campaigns in the tenant
4-SCREEN RUNNING BUILD TOUR

Four screens captured from mail-security.cedxsystems.com, in the order operators run them.

Click any screen below to inspect how CEDX Mail Security moves from initial intake to verified cross-estate completion.

01 OVERVIEW
The week in mail, three lines long
The board brief on the Overview reads: block rate 66.3% with 320 threats scored this week, 95 critical stopped before delivery; the vendor bank-change wave spoof cluster is the live storyline. Underneath it, the numbers the sentences came from.
02 BEC RADAR
Who is at risk right now
Twelve cells, worst first: the CFO at 96, legal ops at 96, the finance shared mailbox at 94, vendor management at 80. Each cell says why, payment path, executive display-name match, direct-deposit authority, and links to the evidence.
03 SPOOF BOARD
The campaigns attacking you this week
Tax-season W2 phish at 60 messages, MFA-fatigue helpdesk spoof at 64, a partner-portal clone carrying malware. Each campaign card shows pattern, blast score, message count and status: active, watch, contained.
04 THREATS
The corpus, row by row
“Wire approval needed today, vendor ACH”: BEC, critical, confidence 94, quarantined. “Gift card request, team offsite”: blocked. The demo corpus is 320 threats and the screen says so; nothing here claims your mail.
01 OVERVIEW · MAIL-SECURITY.CEDXSYSTEMS.COM

The week in mail, three lines long

● Live Screen Capture

The board brief on the Overview reads: block rate 66.3% with 320 threats scored this week, 95 critical stopped before delivery; the vendor bank-change wave spoof cluster is the live storyline. Underneath it, the numbers the sentences came from.

✓ Ask-the-analyst bar with the questions people askVerified in /app/mail-security
✓ Detected versus blocked, weekly, with event markersVerified in /app/mail-security
✓ Quarantine aged 57: held mail gets old on purposeVerified in /app/mail-security
The week in mail, three lines long
OPERATING CADENCE · IT MANAGEMENT & SECURITY

How CEDX Mail Security runs across the week, in the exact order work happens.

When an employee changes roles or leaves in CEDX People, their SSO session, standing database grants, hardware asset, and Vault keys update in one second.

STAGE 01

Capture & Ingest

Records land in CEDX Mail Security already linked to the canonical customer, employee, or vendor ID.

STAGE 02

Score & Triage

Deterministic rules and auditable Copilot signals rank every item by financial and SLA impact.

STAGE 03

Execute & Approve

Operators resolve work in one click with role-based guardrails and instant cross-app writeback.

STAGE 04

Reconcile & Report

Every completed action updates live executive dashboards and the immutable audit log automatically.

OPERATOR WORKSPACES · WHO RUNS CEDX MAIL SECURITY

Three roles open CEDX Mail Security every day. Each sees the exact surface they own.

Role-based views and permissions are enforced at the database row level so executives, managers, and frontline operators share one source of truth.

Security awareness lead using CEDX Mail Security

Security awareness lead

Turns the live campaigns into the training people actually get: the vendor bank-change wave is this week's lesson because it is this week's attack.

● active campaigns · 15
Messaging security admin using CEDX Mail Security

Messaging security admin

Works the quarantine and the delivered-risk tab, tunes the block rate, and owns the 11 high-risk principals' protections.

● quarantine held · 109
Finance ops reviewer using CEDX Mail Security

Finance ops reviewer

Reads the BEC radar before payment runs: vendor bank-change requests now get verified against a named campaign, not a hunch.

● BEC high risk · 11
ONE CANONICAL RECORD ACROSS 132 APPLICATIONS

Security That Governs Users, Endpoints, Secrets, and App Rows From One Console

CEDX Mail Security is not an isolated point tool. It reads and writes the exact same customer, ledger, and identity records as the rest of the CEDX software estate.

CONNECTED MODULE 01 Open /siem/ ->

CEDX SIEM

A phish report arrives in the event stream as its own action type, next to the auth and lateral-movement events it predicts.
CONNECTED MODULE 02 Open /access/ ->

CEDX Access

The 11 high-risk principals are identities with grants. BEC risk times standing privilege is the number Access keeps visible.
CONNECTED MODULE 03 Open /endpoint/ ->

CEDX Endpoint

The attachment that did get clicked becomes an endpoint detection: mass file encryption has a verdict and a confidence there too.
CONNECTED MODULE 04 Open /compliance/ ->

CEDX Compliance

Security-awareness and phishing controls are rows in the controls library. The campaign log is the evidence.
ARCHITECTURAL PROOF · OPERATOR PERSPECTIVES

Why enterprise operators replace stitched SaaS stacks with CEDX Mail Security.

"Having identity, least-privilege access, audit trails, and business applications on one kernel cut our security review and provisioning time by 82%."

Sarah Lindqvist
Sarah Lindqvist
Chief Information Security Officer · Atlas Corp

"We started with one application to fix our most painful bottleneck, and added five more modules on the same login without a single migration project."

Arjun Patel
Arjun Patel
SVP of Global Operations · Keystone Logistics

"Consolidating onto CEDX eliminated four middleware connectors and cut our weekly forecast and close reconciliation from two days to twelve minutes."

Marcus Vance
Marcus Vance
Chief Revenue Officer · Meridian Systems
LIVE TCO & CONSOLIDATION MODEL · IT MANAGEMENT & SECURITY

Stop paying five vendors to re-sync the same it management & security record.

Drag the seat slider to compare your current stitched stack (CrowdStrike + Datadog SIEM + CyberArk + HashiCorp Vault + Jamf + Kandji) against running CEDX Mail Security natively on the unified CEDX estate.

Organization Seats 250 seats
25 seats 500 seats 1,250 seats 2,500 seats
Legacy Stitched Stack
CrowdStrike + Datadog SIEM + CyberArk + HashiCorp Vault + Jamf + Kandji
$1,380,000 / yr
CEDX Mail Security + Full Estate Bundle
All 132 applications · Canonical Postgres · Unlimited Copilot
$267,000 / yr
Verified Annual Hard Savings
Plus 0 middleware sync failures
$1,113,000 / yr
TECHNICAL & PROCUREMENT FAQ · CEDX MAIL SECURITY

Questions operators and architecture teams ask before piloting CEDX Mail Security.

01 Is the software on this page real? +
Yes. Every screenshot is a capture of the running build and you can open the same build at /app/mail-security . The threats are a demo corpus: the screen says so.
02 What is the BEC radar? +
A scored view of the 64 principals most worth impersonating, executives, finance roles, shared payment mailboxes, by transparent signal weights: payment-path authority, VIP flag, executive display-name matches in inbound mail. Click a cell and the evidence opens.
03 How does campaign clustering help? +
One blocked phish is a blocked phish; 48 related messages across 4 mailboxes is a campaign with a name, a blast score and a status. Clustering turns individual verdicts into a board you can brief from. The Overview does exactly that in three lines.
04 What happens to mail that is delivered but risky? +
It lands on the delivered-risk tab, 28 in the demo, with the verdict and confidence still attached, so nothing disappears into an inbox just because it was not blocked.
05 Is Mail Security audited or certified? +
No certification has been issued. What we can evidence about hosting, encryption and tenant isolation is written up on the security page .
LIVE SANDBOX · ZERO MIDDLEWARE · NO CARD REQUIRED

CEDX Mail Security is running right now. Open it and inspect the record.

Explore the live CEDX Mail Security workspace on canonical demo data at /app/mail-security, or book a 30-minute architecture session to map your first entity rollout.

Open live CEDX Mail Security (/app/mail-security) -> Book an estate architecture map