Agari Phishing Defense looks for attackers trying to exploit spoofing the friendly from for your top users you assigned in the Address Group section. Utilizing this feature is a great way to protect you from attackers using your CEO's name in the friendly from, but not actually coming from them. However, from time to time you may notice that the CEO or someone else in an Address Group is emailing themselves from their personal account to their work account, and thus triggering the Impostors Policy.
To resolve this, first, verify the email as their personal email, and then add it to the Exceptions section under Manage > Address Groups > Group Name > Exceptions.
Please sign in to leave a comment.