❶ Prerequisites
Before installing Slash, make sure the following elements are already set up in your Riot workspace:
Your Inbox module is already installed and operational.
Your Google or Microsoft workforce is synchronised with Riot (otherwise, this step will be offered during installation).
The Slash feature has been enabled for your workspace by your Riot contact.
👍 Good to know: if the Slash section does not yet appear in your Inbox module settings, contact your Riot Account Manager.
❷ Enable Slash in Inbox
Once the feature has been enabled for your workspace:
Go to Inbox > Settings > Slash.
Enable the Slash toggle.
Follow the on-screen instructions to move on to the next step (synchronisation and permissions).
❸ Choose the protection mode
Slash offers three protection modes. The mode determines what Slash does with a detected email. You set it in Inbox > Settings > Slash and can change it whenever you like:
👉 Warning (banners)
Slash displays a contextual banner in every detected email, whether it is malicious or merely suspicious. No email is blocked automatically: your employees see the email and its warning.
👉 Auto-remediation (blocking)
Emails detected as malicious are blocked: the employee never sees the attack, so there is no risk of a click or a reply. Emails that merely call for caution, such as a request to change bank details or a suspicious attachment extension, keep their banner. On Microsoft 365, the blocked email is placed in a folder hidden from employees; on Gmail, it is placed in spam. Every blocked email appears in Inbox: you stay in control. To find out more, see the article Slash: Auto-remediation mode.
👉 Audit
Slash analyses every incoming email but takes no action: no banner, no email moved, and your employees see nothing. You can find malicious emails in Inbox, along with statistics on what Slash has detected. This mode lets you test Slash without disrupting your employees and without any prior internal communication. To find out more, see the article Slash: Audit mode.
👍 Good to know: in every mode, the emails detected by Slash automatically appear in Inbox with the Flagged status, without waiting for an employee to report them. Inbox only shows emails detected since this feature was introduced.
❹ Grant the required permissions
Slash requires permissions on your email environment to function:
Read access to emails: to analyse the content and detect fraudulent emails.
Write access to emails: to inject warning banners into suspicious emails and remove malicious emails from the inbox.
The procedure differs depending on your email provider:
👉 For Google Workspace
Go to the Google Admin Console at the following address: https://admin.google.com/ac/owl/domainwidedelegation, then add the two required scopes for the Riot Client ID.
Client ID:
115224877434903164740Scope #1:
https://www.googleapis.com/auth/gmail.modify
Allows Slash to read emails and inject Albert banners when a dangerous email is detected. Also allows confirmed malicious emails to be moved to spam.Scope #2:
https://www.googleapis.com/auth/pubsub
Allows Slash to receive real-time notifications when a new email arrives.
👉 For Microsoft 365 / Outlook
Grant Slash the Mail.ReadWrite permission through the Outlook API permissions. If you have already deployed Riot's Simulation module, this permission has most likely already been granted: you do not need to do anything.
👍 Good to know: Slash cannot function without these permissions. Without read access, Slash cannot analyse emails. Without write access, it cannot display warning banners in your employees' mailboxes or remove malicious emails.
❺ Verify the configuration
Once the permissions have been granted:
An email is automatically sent to the administrator who started the installation.
Open this email and click “Verify configuration” to complete the installation.
If the verification succeeds, Slash immediately starts analysing your organisation's incoming emails.
❻ Configure the notification channel
This step is essential for the internal impersonation protection workflow: this is the channel Riot uses to automatically contact an employee whose identity appears to have been impersonated.
Go to Settings > Notifications and enable the channel of your choice:
Slack
Microsoft Teams
Google Chat
If none of these channels is available, Riot will use email as a fallback.
❼ Enable impersonation protection (optional)
In the Slash settings, you can enable the Auto Impersonation Protection option. When it is enabled and internal impersonation is suspected, Albert automatically contacts the impersonated employee through the notification channel configured in the previous step to verify that the email is legitimate.
❽ Enable Block Threat (recommended)
Block Threat is an Inbox option that amplifies the effect of a report: from a single email that has been reported and confirmed as malicious, the attack is neutralised across the whole organisation.
Go to Inbox > Settings > Security actions and enable Block threat.
👉 With Block Threat enabled:
When a ticket is confirmed as malicious (by an employee or an admin), all emails from the same attack are removed from the mailboxes of all the employees concerned (hidden folder on Microsoft 365, spam on Gmail).
Future emails from the same attack are automatically removed on arrival, in real time.
If an admin reclassifies the email as safe, the emails are restored to the inboxes.
👍 Good to know: on Microsoft 365, removed emails are placed in a folder hidden from your employees: they can no longer access them from their mailbox. On Gmail, this is not possible: removed emails are placed in spam. Riot simulation emails are the exception: they are always moved to the trash.
👍 Good to know: an attack is identified by the combination of sender address + email subject. The system handles the random variations that attackers insert into the subject (names, identifiers, random strings) to get around traditional filters.
Key takeaways
Installation is done from Inbox > Settings > Slash, in just a few steps.
The protection mode (Warning, Auto-remediation or Audit) is set in Inbox > Settings > Slash and can be changed at any time.
Slash needs read and write access to your email environment to analyse emails and act on them.
Remember to enable a notification channel (Slack, Teams or Google Chat) to benefit from the automatic impersonation workflow.
Enable Block Threat in Inbox to neutralise an attack across the whole organisation from a single report.