Emails as Events: First Look at LimaCharlie Email Security

When a phish lands, the questions that matter sit outside the inbox: whether the user opened the attachment, whether it ran, and what that account can reach. Most email security tools stop at the message. LimaCharlie Email Security answers those questions in one place by treating every message as an event in the same data lake as your endpoint, cloud, and identity telemetry.

On October 14, 2026, CEO and Founder Maxime Lamothe-Brassard gave the first public demo of LimaCharlie Email Security. He walked through connecting a mail tenant, reading explainable verdicts, sweeping a phishing campaign, and pivoting from a delivered phish to the recipient's endpoint and cloud resources — all within the same platform MSSPs already use for endpoint and cloud coverage.

What the session covered:

• •Connecting a mail tenant and walking through the first judged messages, including the signals and weights behind each verdict
• •Clustering a phishing campaign and sweeping it from every mailbox it hit
• •Following a delivered phish to the recipient's endpoint, confirming whether the attachment executed, and pivoting into the cloud resources that user can access
• •Running AI triage on the model and provider of your choice, with API key permissions deciding what the agent is allowed to do
• •Packaging connections, policy, and rules as code and deploying the same email security baseline to every client org