❶ What is Auto-remediation mode?
Auto-remediation mode is a Slash protection mode that blocks malicious emails before your employees see them. Obvious phishing emails are removed from the employee's mailbox as soon as they are detected, so there is no risk of a click or a reply.
Slash only blocks emails it is extremely sure about, to avoid blocking a legitimate email by mistake. Emails that merely call for caution are not blocked: they keep their banner.
💡 Prerequisite: Slash must be installed on your workspace. To install it step by step, see the article 2️⃣ How to install detection banners (Slash).
❷ Auto-remediation, Warning or Audit: what is the difference?
Slash offers three protection modes. Here is what sets them apart:
| Warning | Auto-remediation | Audit |
Analysis of incoming emails | Yes | Yes | Yes |
Malicious email | Banner | Blocked: removed from the employee's mailbox | No action |
Suspicious email | Banner | Banner | No action |
Visible to employees | Yes, through the banners | Only the banners of suspicious emails | No |
Visible to admins | Detected emails in Inbox | Detected and blocked emails in Inbox | Malicious emails in Inbox and statistics |
For details on the other two modes, see 1️⃣ Understanding Slash: Detection banners and Slash: Audit mode.
❸ What Slash blocks, what Slash flags
Slash sorts its detections into two levels:
Malicious emails: with Auto-remediation, they are blocked. The employee does not see them.
Suspicious emails: the employee should stay cautious, but the email is not judged malicious with certainty. It is not blocked and keeps its banner. This is the case, for example, of a request to change bank details or a suspicious attachment extension.
👍 Good to know: blocking only applies to emails Slash is extremely sure about. When in doubt, the email stays in the mailbox with its banner, and the employee keeps the usual three actions (Report, Trust, Learn more).
❹ Where does the blocked email go?
The blocked email is removed from the employee's inbox:
on Microsoft 365, it is placed in a hidden folder: the employee can no longer access it from their mailbox;
on Gmail, it is placed in the spam folder.
👉 On the admin side
Every email blocked by Slash appears in Inbox: you stay in control of what has been blocked. A filter lets you display all the emails blocked by Slash.
The ticket created in Inbox follows your processing mode: with manual or AI-assisted processing, the ticket moves to Needs review and the email stays blocked, as if in quarantine, until you decide; with fully automated processing, the ticket is resolved automatically.
❺ Enabling Auto-remediation mode
The Auto-remediation option is available to all Slash customers, in Inbox > Settings > Slash.
In the Slash settings, select Auto-remediation mode:
👍 Good to know: you can change protection mode from the Slash settings whenever you like.
Key takeaways
Auto-remediation mode blocks malicious emails before the employee sees them: no risk of a click or a reply.
Slash only blocks emails it is extremely sure about; emails that are merely suspicious keep their banner.
On Microsoft 365, the blocked email goes to a hidden folder; on Gmail, to spam.
Every blocked email appears in Inbox: you stay in control.
The option is set in Inbox > Settings > Slash.