What it does

PhishSquad is an evidence-first phishing triage agent. Forward a suspicious email to the PhishSquad inbox, or paste it into the live threat desk, and the pipeline gathers forensic evidence first, then asks the AI to judge, then lets an independent trust scorer overrule the AI when the evidence disagrees. It is built for small teams with no security staff: forward it, get an answer in seconds, with the evidence attached.

Inspiration

Our earlier fine-tuned phishing model scored 100% on a 45-email synthetic benchmark but only 25.26% recall on a 200-email real-world corpus. That domain shift was the spark: a model that aces the lab can still miss roughly 3 in 4 real threats. At the same time, business email compromise alone cost $3.05 billion in 2025 (FBI IC3, 24,768 complaints), and the people most exposed are employees with no training and no tools. We rebuilt around one rule: never let the AI judge alone.

How we built it

Four stations, in order. (1) Extractor: pure-stdlib parsing that unwraps multipart and HTML-only mail and pulls headers, links, and authentication results. (2) Evidence: 10 deterministic checks, including SPF/DKIM/DMARC failures, reply-to mismatch, lookalike domains, display-name spoofing, credential and payment harvest language, domain age via RDAP, first-time sender history, and Tavily threat intel three ways: sender domain, link domains (capped at 5 per email), and landing-page content via Tavily Extract. (3) Classifier: nvidia/nemotron-3-super-120b-a12b (Nemotron 3 Super) via Nebius Token Factory, used as-is with no fine-tuning, reading a structured FACTS brief, never the raw email, through the OpenAI-compatible endpoint. Every classification is a live API call. (4) Validator: an independent trust scorer that discards the model's confidence and scores from evidence alone. Trust = 1.0 minus the sum of fired check weights. Trust at or below 0.35 convicts, at or above 0.90 acquits, and in between the model's verdict stands. Unparseable output is retried once, then fails closed to needs_review. Poller verdicts land in a timestamped audit log, and a 16-attack red-team battery is published as a risk register: 10/16 held on the first run, 14/16 after prompt hardening, with 5/5 injections and 2/2 extractions held and zero prompt leakage.

Challenges we ran into

Forwarded mail blinded us. A real forwarded payment-harvest lure was auto-acquitted while the model correctly called it phishing, because the evidence layer only saw the forwarder. The audit log exposed the contradiction, which was the governance win inside the failure. We shipped two fixes: payment-harvest phrases and a raised acquittal bar (0.75 to 0.90). The shipped benchmark moved from 35/60 to 32/60, with zero new false convictions of legitimate mail, and we kept that trade. A residual hole remains: a clean-looking phish with zero evidence firing still auto-acquits, and we state that openly. Benchmark labels were also an AI first pass, not human-reviewed, with era-biased honeypot traffic, so we report the methodology, not just the number: a fixed-seed, stratified 60-email sample from an 873-email corpus, one variable changed at a time.

What we learned

A security tool that cannot show its work cannot be trusted. Evidence must be checkable, the scorer must be independent of the model it supervises, and disagreement between model and scorer must be preserved in the log, not hidden. Red-team your own model before you ship claims about it, and measure every change against the same fixed sample, or you are tuning to noise.

Try it on the live demo: SAMPLE PHISH, then ANALYZE.