AI phishing analysis and incident response

AI triage
your SOC
can check.

MARS reads the suspicious mail your employees report and the incidents Microsoft Defender XDR raises. It gathers the evidence, asks an AI model for a judgement, and publishes only the answers that evidence supports.

See how it works Why MARS

Self-hostedBring your own modelVersion 1.5AGPL-3.0

MARS AI verdict card for a phishing email — A real MARS screen. The email is a synthetic example.

The problem

AI triage is easy to build and hard to trust.

Security teams want a model to take the first pass. Four things get in the way.

Too much to read

Reported mail and XDR incidents arrive faster than a small team can open them.

Confident is not correct

A model can sound certain and be wrong. A wrong "safe" is expensive.

The input is hostile

The mail was written by an attacker, sometimes with text aimed at the AI.

The data is sensitive

Reported mail holds internal correspondence. It cannot go to just any cloud service.

Keep exploring

How it worksThe four steps from a new case to a published answer, and what MARS checks in mail and in XDR incidents.Open Why MARSHow MARS keeps the model inside a pipeline it controls, so the AI's answers can be checked.Open ProductThe console pages, the services MARS connects to, and how it runs on your own host.Open SecurityThe controls at each boundary hostile input crosses, and the limits MARS states openly.Open FAQShort answers on setup, models, what is sent to the AI and what MARS will not do alone.Open