// SECTION: ZERO_TRUST_GATE
001
Design Partner Beta — 5 MSP Slots

Close the
Identity Gap in
M365 & Workspace.

Hardened Identity for Business Email

Standard filters detect threats. IntegrityLayer verifies intent. Implement autonomous Step-Up MFA for high-risk outbound transactions—no MX or DNS changes required.

Apply for Design Partner Beta Technical Brief

Engineered for Family Offices and Financial MSPs.

$47B
BEC losses 2024
0
Bypasses possible
<500ms
Intercept latency
9:41
IntegrityLayer now
High Risk Intent Detected
Wire transfer request · $47,500
From: cfo@acme-corp.com
Deny
Verify →
Step-Up MFA Required
TOTP code expires in 30s
// SECTION: THREAT_MODEL
002

Your AI Email Filter
Has a Fatal Gap.

Microsoft Defender, Abnormal Security, Proofpoint — every passive AI filter in the market shares the same architectural flaw. They analyze. They alert. They can't stop a confirmed session.

01
Passive Detection Only
AI filters classify incoming messages. If the session token is valid, the attacker is authenticated. There's nothing to classify as suspicious.
02
No Physical Gate
Alerts route to admins, not to the transaction itself. By the time a human reviews, the wire is processing.
03
Session Hijacking Wins
A stolen OAuth token makes the attacker indistinguishable from the CFO. SPF, DKIM, DMARC — all pass. Mail looks clean.
attack_simulation.log
# SCENARIO: CEO Account Compromise
# VECTOR: OAuth Token Theft via Phishing
[09:14:32] Attacker steals OAuth refresh token
[09:14:38] Opens CEO mailbox via Graph API
[09:14:51] Drafts wire transfer request to Finance
[09:14:55] DEFENDER: SCORE=0.12 — CLEAN
[09:14:55] ABNORMAL: BASELINE_MATCH — DELIVERED
[09:15:03] Finance approves. Wire processed.
[09:15:03] $47,500 transferred. Unrecoverable.
# Session was valid. Mail was real. No filter caught it.
_

"Without a physical gate, a perfect AI-crafted email from a compromised session is indistinguishable from the real thing."

The IntegrityLayer Design Principle

// SECTION: SNATCH_RELEASE_ENGINE
003

How IntegrityLayer Works

API-driven intercept at the account level. No MX changes. No DNS changes. No browser extensions. Closes the identity gap the moment you grant API consent.

System Blueprint
SEQUENCE_DIAGRAM
CEO Account
Compromised
M365 / GWS
Graph · Pub/Sub
IntegrityLayer
Cloudflare Worker
GPT-4o-mini
Intent Classifier
Quarantine
Hidden Archive
CEO Device
Physical MFA
→
→
→
→
→
sends wire transfer
webhook fires
intercepts in 200ms
classifies HIGH_RISK
snatches to archive
TOTP verification

Attacker steals OAuth refresh token via phishing. Opens CEO's mailbox via Microsoft Graph API. Drafts wire transfer to a mule account — from a valid, authenticated session.

Flow · Node Sequence
00
CEO Account
Compromised session
01
Graph API
Microsoft webhook
02
IntegrityLayer
Cloudflare Worker
03
Quarantine
Hidden archive
04
CEO Device
Physical MFA
integrity_layer · intercept.log
# Step 1 of 3 · Compromised Session
[09:14:32]OAuth token stolen via credential phishing
[09:14:38]Attacker opens CEO mailbox via Graph API
[09:14:51]Draft: 'Please wire $47,500 to routing #...'
[09:14:55]DEFENDER: SCORE=0.12 — CLEAN (session valid)
[09:14:55]ABNORMAL: BASELINE_MATCH — DELIVERED
_
// SECTION: COMPETITIVE_ANALYSIS
004

Passive Detection vs.
Active Physical Gate

Every existing solution alerts after the fact. IntegrityLayer stops the transaction before it happens.

Capability
MS Defender
Abnormal
IntegrityLayer
Detection method
✗ ML pattern matching on content/sender
✗ Behavioral AI baseline deviation
✓ LLM intent classification (GPT-4o-mini)
Response to high-risk mail
✗ Alert admin. Email delivered.
✗ Quarantine. Admin reviews later.
✓ Instant API quarantine. Sender challenged immediately.
Session hijacking protection
✗ None — valid session = trusted sender
✗ Partial — may flag unusual behavior
✓ Full — physical MFA required regardless of session
Mobile coverage
✗ Push notifications only
✗ Push notifications only
✓ Account-level API — iOS, Android, desktop, web
Wire / payroll gate
✗ Passive alert, no blocking
✗ Passive alert, no blocking
✓ Active physical gate before delivery
Bypassable by attacker?
✗ Yes — valid session bypasses
✗ Often — if mail appears normal
✓ No — requires physical device attacker doesn't have

Comparison based on published capabilities as of 2025. MS Defender = Office 365 Plan 2.

// SECTION: FAIL_SAFE_ARCHITECTURE
005

The MSP Deal-Breakers,
Answered.

Every MSP director asks three questions before deploying email security to a client. Here are the technical answers.

30-second setup A

One-Click Deployment

Grant API permissions via Azure Enterprise App or Google Workspace Marketplace. No mail routing. No MX record changes. Set your risk policy, deploy.

Azure Enterprise App (Graph API)
Google Workspace Marketplace
No DNS / MX changes required
Configurable risk threshold
# admin/config.yml
risk_threshold: 0.75
mfa_type: totp
fail_mode: open
Fail-open design B

Zero Mail Flow Risk

If the Cloudflare Worker is unreachable, mail flows directly to inbox — uninterrupted. Your client's email never depends on our uptime.

Cloudflare SLA 99.99%
Intercept latency <500ms
# Reliability policy
on_timeout: deliver # fail-open
latency_budget: 500ms
Protocol-level C

Native Mobile Coverage

Interception happens at the account API layer — not the browser or extension layer. The CEO can be on an iPhone or a desktop. It doesn't matter.

Platform
Coverage
iOS Outlook
✓ Full
Android Gmail
✓ Full
Desktop Outlook
✓ Full
OWA / Gmail.com
✓ Full
// SECTION: DESIGN_PARTNER_BETA
006
3 OF 5 SLOTS REMAINING

Shape the Product.
Get Paid Back in Kind.

We're looking for 5 specialized MSPs in Financial and Legal to help us validate the risk policy engine, admin dashboard, and client reporting before general availability.

01
Permanent NFR License
Full IntegrityLayer deployment for your own team's Microsoft 365 or Google Workspace. Not-For-Resale. No expiry.
02
Direct Engineering Access
Weekly calls with the founding team. Your operational feedback goes directly into the admin portal and risk engine roadmap.
03
Preferred Partner Pricing
Locked-in rate for your client deployments at commercial launch. Partners who build with us grow with us.
🔒
AES-256
Encrypted Audit Logs
✓
SOC 2
Compliant Infrastructure
⚡
Fail-Open
Zero Mail Flow Risk
☁
Cloudflare
US-East Processing
Apply for Partner Beta SECURE FORM

Financial & Legal MSPs prioritized. Response within 48 hours.

▾

No commitment required · We respond within 48 hours