Email spoofing protection across North East businesses
Public DNS records for 192 North East businesses, read on one day: how many publish a rule that would stop an email forged in their name reaching their clients.
25 September 2026
EMAIL SECURITY RESEARCHWhat we measured, and how.
Research Jatzo publishes from public records. Each study says what it read, how the sample was built and what it excluded, so anybody can check it or repeat it. No business is ever named.
Four kinds of research are published here. Studies measure something across many organisations from public records, such as whether North East firms publish the email records that stop their domain being forged. Case studies read one real attack from the published record. Threat reports set out one technique, with every claim sourced and with what an email analyser can and cannot see of it. Reference pages describe Jatzo itself, such as where its detection rules sit in MITRE ATT&CK.
Studies
Each reads public records, says how its sample was built and what it excluded, and is true of the day it ran.
Case studies
A real attack, read from the published record, with what it teaches about the next email.
When a convincing email became a parliamentary crisis
How a targeted email led to the 2015 intrusion into Germany's Bundestag, what the reported entry route was, and three things to remember about spear phishing.
Threat reports
Published research on one technique, read and set out with every claim carrying its source, and with what an email analyser can and cannot see of it stated plainly.
ClickFix: getting the victim to run the command
A technique that skips the attachment and the malicious link by getting the reader to paste the command themselves, and what an email analyser can see of it.
29 September 2026
Device code phishing: the sign-in page is real
An account takeover where nothing is spoofed and the victim completes multi-factor authentication correctly, and what email analysis can and cannot see.
29 September 2026
Reference
How Jatzo itself behaves, written against the code rather than against the world, and kept current with it.
Jatzo's detection rules, mapped to MITRE ATT&CK
Every detection rule in the product placed in MITRE ATT&CK Enterprise, with the ones that deliberately map to nothing and the reason each carries none.
28 September 2026