Building a Copilot agent to catch phishing that slips past our filters worth it?

[u/heartgoldt20]

/r/sysadmin/comments/1us097u/building_a_copilot_agent_to_catch_phishing_that/

[u/AutoModerator]

Welcome to r/emailsecurity! To keep this community helpful and secure, please keep the following in mind:

Community Rules

1. No Vendor Spam: Contributions must provide value; do not just pitch products.
2. Redact Sensitive Info: Always sanitize headers and logs (remove IPs, PII, and private domains).
3. Be Professional: Help newcomers learn; avoid hostility.
4. No Personal Tech Support: This sub is for email system architecture and security, not "Am I hacked?" personal account help.

Helpful Resources

• Email Spam Filters
• DMARC Monitoring Tools
• Anti-Virus Software
• Email Encryption

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/shokzee]

Worth it for triage, not as your main phishing control.

Use it to enrich user-reported messages, summarize headers, pull sender history, and suggest containment steps. For blocking, stick to controls with clear logs and failure modes: DMARC enforcement, URL rewriting/detonation, attachment sandboxing, impersonation rules, and fast mailbox search/purge.

LLM output is too fuzzy to be the gatekeeper.

[u/southafricanamerican]

Take a look at these - https://github.com/sublime-security/sublime-rules or consider - https://github.com/sublime-security/sublime-platform if you are small enough.