❶ What is Slash?
Slash is Riot's solution that protects your employees against sophisticated, targeted phishing attacks that get past Google's or Microsoft's native filters.
Slash is installed alongside your mailbox (Gmail or Outlook) and relies on large language models (LLMs) to analyse the context and intent of every incoming email. When an email is deemed suspicious, a detection banner is injected directly into the body of the message to alert the employee.
👉 The three key features:
Email protection: real-time analysis of all incoming emails.
In-context alert: the banner is displayed directly in the employee's mailbox, with no change of context.
Impersonation protection: when Slash suspects that an employee is being impersonated, Albert automatically asks the person concerned for confirmation via a secure channel (Slack, Teams or Google Chat).
👍 Good to know: Slash complements your existing defences without interfering with them. It works alongside Microsoft Defender, Mimecast, Proofpoint or any other upstream filter, because it relies on the Gmail and Outlook APIs and acts directly in the user's mailbox.
❷ How does detection work?
Slash relies on a hybrid model that combines two complementary approaches:
Contextual metadata analysis: assessing the security of domains, URLs and headers, and estimating the reliability of external senders based on how often you have exchanged with them in the past.
Semantic analysis: based on large language models (LLMs), it identifies typical phishing scenarios from the context and tone of the message.
👉 Phishing scenarios detected:
Employee impersonation: the sender poses as an internal employee to manipulate the recipient into performing a sensitive action.
Service impersonation: the email imitates a well-known online service (DocuSign, Microsoft, etc.) to steal credentials.
Extortion attempt: a threatening message demanding payment, claiming to hold compromising information.
Partner payment fraud (warning): an attempt to impersonate a business partner in order to request a payment or a change of bank details.
Suspicious indicators (warning): the email shows technical signals associated with phishing, without matching a specific scenario.
👍 Good to know: unlike many solutions, Slash does not trigger an automatic alert for every new sender. Only emails deemed potentially malicious generate a banner, which avoids flooding employees with unnecessary alerts and keeps the signal meaningful.
❸ The detection banner
From the employee's point of view, Slash alerts appear directly in the body of the email as an interactive banner.
Each banner contains:
A contextual explanation: a short description of the reason for the alert (suspicious tone, sense of urgency, domain inconsistency, dubious URL, imitated service…). It helps the employee understand the risk and gradually builds their security reflexes.
Three possible actions directly from the banner.
❹ Protection modes and Inbox
The Slash protection mode is set in Inbox > Settings > Slash. It determines what Slash does with a detected email:
Warning: a banner is displayed in every detected email, whether malicious or merely suspicious. No email is blocked automatically. This is the mode described in the rest of this article.
Auto-remediation: obvious malicious emails are removed from the employee's mailbox as soon as they are detected, before the employee sees them: there is no risk of a click or a reply. Slash only blocks emails it is extremely confident about, to avoid blocking a legitimate email by mistake. Emails that merely call for caution, such as a request to change bank details, keep their banner. On Microsoft 365, the blocked email is placed in a folder hidden from employees; on Gmail, it is placed in the spam folder. Every blocked email appears in Inbox: you stay in control.
Audit: Slash analyses every incoming email but takes no action: no banner, no email moved, and your employees see nothing. It lets you test Slash without disrupting them. For details, see the article Slash: Audit mode.
👉 Detected emails appear in Inbox
Every email detected by Slash appears automatically in Inbox, without waiting for an employee to report it. It is given the Flagged status: detected by Slash and not yet reviewed by an admin. The Flagged by Slash filter displays all of them, and an admin can act on an email even before it is reported.
👍 Good to know: Inbox only shows emails detected by Slash since this feature was put in place: past history is not backfilled.
❺ The three actions available from the banner
👉 Report
The email is immediately removed from the inbox of the employee who reports it (hidden folder on Microsoft 365, spam folder on Gmail).
A ticket is created in Inbox (or updated if another employee has already reported the same email).
If the Block Threat option is enabled in Inbox and the ticket is confirmed as malicious, the email is removed from the mailbox of every employee who received it, and future emails from the same attack are blocked on arrival.
👍 Good to know: on Microsoft 365, removed emails are placed in a hidden folder that your employees cannot see, so they can no longer access them from their mailbox. Gmail does not allow this: removed emails are placed in the spam folder. Riot simulation emails are the exception: they are always moved to the trash.
👉 I trust this sender (Looks safe)
The banner disappears and the employee can reply to the email as usual.
Slash remembers that the sender's domain is considered safe for this employee only: other employees still see the banner if the sender contacts them.
👉 Learn more (Ask Albert)
The employee opens the flagged email, with Albert at their side.
The elements spotted by Slash are highlighted in the email: the sender, a link, a sentence. By clicking one of them, the employee asks Albert what is wrong, and Albert explains it.
The employee can keep asking questions, choosing from the suggested questions or writing their own.
The conversation is saved: the employee can pick it up again later.
👍 Good to know: the employee no longer just sees what Slash detected: they can point to the suspicious part and ask why. This is what turns every alert into a learning moment.
❻ The internal impersonation protection workflow
Slash offers an automatic verification workflow when impersonation of an internal employee is detected. This feature is enabled in the Slash settings (Auto Impersonation Protection option).
👉 How does it work?
When internal impersonation is suspected, Albert automatically contacts the impersonated employee via a secure channel (Slack, Teams or Google Chat) to check whether the email is legitimate:
If the employee confirms the impersonation ("No, I'm being impersonated"): the email is immediately removed from every mailbox concerned (hidden folder on Microsoft 365, spam folder on Gmail), and a closed ticket is created in Inbox for follow-up.
If the employee confirms it is legitimate ("Yep, that was me"): the banner is removed and the email stays in the inbox. No ticket is created.
👍 Good to know: unlike the other scenarios, where the employee has to report the email manually from the banner, the impersonation workflow is fully automatic. Albert triggers the verification without waiting for any action from the user.
❼ Link and QR code analysis
Part of the detection focuses on what the email contains rather than on how it is written.
👉 Links are checked against known threat databases
Every link in an email is checked against Google Safe Browsing, the database of phishing and malware sites you already know from the warnings Chrome displays on dangerous websites.
If there is a match, the email is flagged with a Slash banner or classified as malicious by Inbox.
👍 Good to know: this check applies to all emails, including exchanges with your colleagues or trusted partners. This is precisely what makes it possible to detect a compromised mailbox: a legitimate sender whose account has been hacked sends genuinely malicious links from an address nobody suspects.
👉 QR codes are decoded
Slash extracts the URL hidden behind a QR code, whether it is in the body of the email or in an image attachment, then applies the same analysis to it as to any other link.
This is a direct response to quishing: a technique that replaces the link with an image, precisely to evade filters that only analyse text.
👍 Good to know: you can hover over each explanation shown in a banner to see the exact excerpt of the email that triggered it. Useful when an employee asks you why their message was flagged.
❽ Compatibility
Slash requires the mailbox to be hosted by Gmail or Outlook, as it uses their APIs to inject the banners. Once injected, the banner displays correctly in all email clients, including:
Apple Mail (macOS, iOS);
Outlook desktop, web and mobile;
Gmail web and mobile (Android, iOS);
any other desktop or mobile client.
Slash analysis adds no delay to email delivery.
Key takeaways
Slash is an additional layer on top of your existing defences (Defender, Mimecast, Proofpoint, etc.).
Analysis relies on a hybrid model: metadata and semantic analysis (LLM).
The protection mode is set in Inbox > Settings > Slash: Warning (banners), Auto-remediation (blocking of obvious malicious emails) or Audit (analysis with no action visible to employees).
Every detected email appears in Inbox with the Flagged status.
The banner offers three actions: Report, Trust, Learn more.
"Learn more" opens the email with the suspicious elements highlighted: the employee can ask Albert about each of them.
The internal impersonation workflow is automatic and triggers a verification via Slack, Teams or Google Chat.