Automated processing of suspicious emails submitted for review

Abstract

Systems and methods for enterprise cybersecurity triaging of emails suspected of malicious content. Triaging may include analyzing threat level of email submitted for cybersecurity review. The systems and methods may deconstruct an email into components scorable for threat type and/or threat level. The systems and methods may include multiple dynamically selectable threat scoring modules. Email threat level may be based on component scores. Evaluated emails and scored components may be stored. Cybersecurity threat analysis may include comparison of the email and/or the scorable components against previously stored evaluated emails and previously stored scored components. Triaging may include identifying enterprise response teams experienced in the threat type and/or threat level of the email and/or of its components. Triaging may include preventing infiltration of an enterprise by malicious emails. The systems and methods may include feedback to enterprise associates regarding detecting and handling potentially malicious emails.