The Email That Could Cost
a Defense Contract

It Always Starts With an Email

A machinist at a defense subcontractor gets an email. It looks like it's from HR. It says there's an update to the benefits portal and they need to verify their credentials. They click. They log in. And just like that, someone who isn't them now has access to systems that handle Controlled Unclassified Information — the kind of data the Department of Defense is legally required to protect.

This isn't a hypothetical. Over 90% of cyberattacks begin with a phishing email. Not a sophisticated zero-day exploit. Not a nation-state hacking team tunneling through your firewall. An email. And the scary part? Most employees who click on phishing emails don't know they did anything wrong. [CISA via Zensec, 2025]

For defense contractors, the stakes are even higher. A successful phishing attack doesn't just cost money — it can mean a failed CMMC audit, a lost contract, and in the worst case, compromised national security data making its way to people who shouldn't have it.

People Learn by Doing, Not by Reading Slides

I've sat through enough security awareness training sessions to know what doesn't work: a slide deck with clipart of a fishing hook, a 45-minute video nobody watches, a quiz everyone retakes until they get 100%. These check the compliance box. They don't change behavior.

What actually works is seeing it in your own inbox. When someone looks at an email they received last Tuesday and realizes — oh, that was a phishing attempt — it lands differently than any hypothetical example ever could. The email is real. The sender is someone they almost trusted. The mistake was almost theirs to make.

That's why I built the Email Threat Analyzer. Not to replace security tooling. Not to compete with enterprise email gateways. To give employees — especially at defense contractors who aren't security professionals — a way to look at their own email and understand what threats actually look like in the wild.

What It Does, in Plain English

The Email Threat Analyzer is a browser-based security tool that connects to your Gmail inbox via Google OAuth — read-only access, nothing stored, nothing sent anywhere it shouldn't go — and runs AI-powered threat analysis on your emails. It maps findings to MITRE ATT&CK techniques, flags indicators of compromise, and explains what to look for in language that doesn't require a security degree to understand.

There are four ways to use it. You can connect your Gmail account directly via Google OAuth. You can upload an exported email file. You can paste raw email headers. Or you can run through six built-in demo samples designed to cover the most common attack patterns — Business Email Compromise, credential phishing, malware delivery, social engineering, and more.

Your AI Security Guide, Not a Chatbot

One of the things I was most deliberate about is that this tool should never make someone feel stupid for asking a question. Security is full of jargon that excludes people — and that exclusion is a security risk in itself. If your employees don't understand why something is dangerous, they can't make good decisions.

CIPHER is the tool's built-in AI analyst. When you open any flagged email, CIPHER is available in a side panel to answer questions about what was found and why it matters. Ask it anything — "what does T1566.002 mean?", "why is a Reply-To mismatch suspicious?", "is this email actually dangerous or just weird-looking?" — and it will give you a straight answer in plain English.

CIPHER updates its context when you open a specific email, so its answers are always relevant to what you're actually looking at — not generic advice. It's not a replacement for a real security analyst, but it bridges the gap between "I got a weird email" and "I know exactly what I'm dealing with."

When I Ran It Against My Own Inbox

The most useful thing I did during development was run the tool against my actual Gmail inbox — 70 real emails from the past 30 days. What I found was genuinely interesting, and it made the tool significantly better.

The false positive problem. The tool kept flagging emails from ALLMODERN, Hotels.com, Glassdoor, and a handful of other legitimate senders as critical threats. At first I thought there was a bug. Then I dug into the raw email data and found something I hadn't expected: these companies were embedding invisible Unicode characters — zero-width spaces and variation selectors — between individual letters of my email address in their tracking URLs. It looked exactly like a known attack technique called Glassworm, which uses the same invisible characters to hide malicious payloads.

Turns out, email marketing platforms do this legitimately for recipient fingerprinting — making each email unique so they can track who clicked what. The technique is identical to the attack. The intent is different. That required me to build detection logic that can tell the difference between a marketing platform's tracking fingerprint and an actual invisible Unicode payload attack.

This kind of finding — discovering that a legitimate technology and a malicious technique are nearly indistinguishable at the byte level — is exactly the kind of nuance that makes security hard. It's also exactly the kind of thing a good security analyst needs to be able to recognize and explain.

Phishing Simulation for Defense Contractors

Here's where this becomes more than a portfolio project. One of the most effective security awareness techniques is the phishing simulation — you send crafted phishing emails to employees, see who clicks, and then use that as a teaching moment. Companies like KnowBe4 and Proofpoint charge significant money for this service. The Email Threat Analyzer makes it something you can do in a controlled, hands-on workshop format.

The engagement looks like this: before the session, I send simulated phishing emails to employees — crafted to match real attack patterns relevant to the defense industry (fake supplier invoices, IT helpdesk password resets, HR policy updates, government portal credentials). During the session, employees connect their work Gmail or upload the emails, and the tool shows them exactly what they received, why it was suspicious, and what they should have done differently.

The difference between this and a slide deck is that they're looking at an email they actually received. The mistake was almost real. The lesson lands.

Why Email Security Is a Compliance Issue, Not Just an IT Issue

Most people in the defense supply chain think of CMMC as an IT problem. Their IT team handles it. They just have to take a training course once a year. That framing is exactly why 99% of contractors are not currently audit-ready.

CMMC is a people problem as much as it is a technical one. The most common initial access vector in defense-related breaches isn't a firewall misconfiguration. It's a phishing email. An employee clicks a link. A credential gets harvested. An attacker sits quietly inside the network for an average of 254 days before anyone notices. By then the damage is done. [Hunto AI, 2026]

The good news is that awareness training actually works — when it's done right. Organizations with active security behavior programs reduce phishing incidents by 86% and employees report threats 4x more often. The key word is "active." Passive training — a video, a quiz — produces passive results. Hands-on simulation produces behavior change. [ControlD / Cisco Talos, 2025]

See What's in Your Inbox

The tool is free, open source, and live. You don't need an account. You don't need to install anything. If you have a Gmail account and a browser, you can run a threat analysis on your inbox right now.

If you're not ready to connect Gmail, start with the Demo Samples — six built-in emails covering the most common attack patterns, with full AI analysis and CIPHER available to answer questions. It takes about five minutes and gives you a real sense of what the tool does.

If you're a defense contractor or CMMC consultant interested in using this as part of a phishing simulation engagement, I'd be glad to talk through how it fits into your workflow. The tool is built to be run in a facilitated workshop — not just handed to employees and forgotten.

Sources