Restack Technology protects Australian organisations from the email threats that get past Microsoft 365 and Google Workspace's built-in filtering, from business email compromise and invoice fraud to account takeover - while making sure legitimate email still lands. We design, deploy and manage email security alongside the platforms you already use.
Email is still the most common way attacks start, and the most convincing ones carry no links or attachments at all, just a believable request from someone who appears to be a colleague or supplier. Our work covers inbound protection, email authentication, account takeover response, data loss prevention, archiving and backup.
Phishing and impersonation emails reaching inboxes every week despite Microsoft 365 or Google Workspace's built-in filtering.
A filter so aggressive that customers, brokers or suppliers go unanswered, and staff learn to work around it.
Requests to change bank details that look like they came from a real supplier or a senior colleague, because sometimes they did.
Unusual sign-ins, inbox rules forwarding mail elsewhere, or a supplier reporting strange emails sent in your name.
Marketing or transactional email going missing since Google, Yahoo and Microsoft tightened their rules for bulk senders.
Contracts, identity documents and financial details that an attacker could search through in minutes after a single compromised password.
Each of these can be engaged on its own, or combined into a layered approach to email security. Open any card for more detail.
Authenticating every domain you send from, moving DMARC to enforcement safely, and monitoring reports so spoofed email is rejected and legitimate senders keep working.
Tuning Microsoft's built-in protection to recommended settings, and adding behavioural, API-based protection that catches the attacks traditional filters miss.
Spotting impersonation of executives and suppliers, invoice fraud and compromised vendor accounts, and removing malicious messages from every inbox once they're found.
Detecting compromised mailboxes from unusual sign-ins and behaviour, then containing them quickly: revoking sessions, resetting credentials and removing malicious inbox rules.
Stopping sensitive information leaving by email, and protecting what is already sitting in mailboxes so a single compromised account doesn't expose years of data.
Retention, legal hold and eDiscovery set up to meet regulatory and legal obligations, without adding a separate system to manage.
Independent backup of mailboxes outside Microsoft 365 or Google Workspace, so mail can be restored after deletion, corruption or ransomware.
A free, fixed-scope review of how well your email is protected today, delivered by Restack's own team. We check your Microsoft 365 or Google Workspace configuration and your domain authentication, and run the protection platform that best fits your organisation alongside your current filtering, in read-only mode, so you can see exactly what is getting through.
We connect read-only to your email platform and review your domains' public DNS records, with nothing changed and no disruption to mail flow.
The platform analyses recent and incoming mail while our consultants review configuration and authentication.
We walk through what we found, what it means and what to fix first.
Eligibility criteria apply.
Microsoft 365 and Google Workspace include sensible baseline filtering. Most of the attacks that cost businesses money are the ones built to get past it, so we add two complementary layers, connected by API with no change to how mail flows.
Behavioural AI that learns how your people and suppliers normally communicate, and flags the messages that don't fit, including text-only requests with no link or attachment for a filter to catch.
Protection for the mailbox itself, for Microsoft 365 and Google Workspace. It reduces what an attacker can reach if an account is compromised, and turns staff phishing reports into automatic protection for everyone.
Whichever platform fits, we also tune Microsoft's or Google's own protection to recommended settings, so each layer does the job it is best at.
Email authentication proves that mail claiming to come from your domain really did. It protects your customers from spoofing, and it is now a condition of reliable delivery to most large mailbox providers.
A published list of the servers allowed to send email for your domain. Simple in principle, and easy to break when new sending services are added without updating it.
A cryptographic signature added to each message, letting receiving servers check it wasn't altered and really came from an authorised sender.
The policy that tells receiving servers what to do when SPF or DKIM checks fail, and sends you reports showing who is sending as your domain. Moving to enforcement is what actually stops spoofing.
Google, Yahoo and Microsoft now require bulk senders to authenticate with SPF, DKIM and DMARC, support easy unsubscribe and keep spam complaints low. Email that falls short is increasingly filtered or rejected.
ASD's Australian Cyber Security Centre recommends SPF, DKIM and DMARC for every domain, including domains that never send email, to stop them being used for impersonation.
An optional standard that displays your verified logo next to authenticated email in supporting mail apps, once DMARC is at enforcement.
Email security work tends to follow the same three stages, and a customer can start at whichever one fits.
A review of current filtering, authentication records, mailbox settings and recent incidents, ending in a short list of what to change first.
Deployment and tuning of Abnormal, Material Security, Microsoft's built-in protection and DMARC enforcement, with careful testing so legitimate mail keeps flowing.
Ongoing monitoring, tuning, DMARC report review and incident response, so new threats and new sending services are handled as they appear.
Email threats cut by over 95% with API-based protection alongside Microsoft Defender, and DMARC, DKIM and SPF optimised across every sending domain, keeping deliverability at 99%+ every month since.
Read the storyA legacy mail filter that was quarantining legitimate business email replaced with Abnormal, cutting business-impacting false positives by over 95%, as part of a wider security uplift delivered in under three months.
Read the storyEmail security run as part of a full managed service across several states, alongside cloud, network, backup and managed detection and response.
Read the storyFor bulk spam and known malware it does a reasonable job, especially when tuned to Microsoft's recommended settings. Where it tends to fall short is targeted attacks with no malicious link or attachment, such as invoice fraud and executive impersonation, which is where a behavioural layer like Abnormal adds the most value.
Business email compromise is a scam where an attacker impersonates, or takes over the account of, a colleague, executive or supplier to trick someone into paying money or sharing information. In ASD's Annual Cyber Threat Report 2024–25, email compromise (19%) and business email compromise fraud (15%) were the two most common cybercrimes reported by Australian businesses, together making up around a third of all business reports.
DMARC is an email authentication policy that tells receiving servers how to treat mail that fails SPF or DKIM checks, and reports back on who is sending as your domain. Yes: ASD recommends it for every domain, and Google, Yahoo and Microsoft now require it for bulk senders.
Not if it is done in stages. We start by monitoring, identify every service that sends on your behalf, fix their authentication, and only then move the policy to quarantine and reject.
Contain it quickly: revoke active sessions, reset the password and MFA, remove any inbox rules the attacker created, and check what was sent or accessed. Abnormal and Material Security can detect and contain many of these automatically, and we can help with the investigation.
No. Abnormal and Material Security both connect to Microsoft 365 or Google Workspace by API, so mail continues to flow exactly as it does today.
Yes. Abnormal, Material Security, EasyDMARC and our backup partners all support both.
Related capabilities: Security, Identity, Data protection, SaaS operations and all capabilities.
Whether threats are getting through, legitimate email is going missing, or you are unsure how exposed your mailboxes are, a short conversation is usually the quickest way to work out the next step.
