Overview

Smart Banners is an email security feature that analyzes incoming emails in real-time and displays contextual warning banners to users when suspicious elements are detected. The system helps protect against phishing, brand impersonation, and other email-based threats that may bypass traditional spam filters.

Key capabilities:

• Real-time email analysis for threat signals
• Visual warning banners with varying severity levels
• User-driven reporting and safe sender marking
• Admin dashboard for monitoring and configuration
• Integration with Microsoft 365 and Google Workspace

Banner types

• Smart Banners draw attention from users on suspicious signals detected on an email and let them qualify the threat.
• 2 possible actions: mark as safe, report.
• Banner color matches the highest signal detected in email: If banner is triggered, every signal will appear on the banner (only few exceptions).
• It is not possible to customize the message that appears in the banners or the colors

⚠️ Once a banner has been added to an email, it can only be removed manually by the recipient.

Grey

A Grey banner - info is displayed when highest signal detected is low. This corresponds to the following signals: first time sender, recent domain, file transfer service, mismatch between From address and Return-Path

Orange

An Orange banner - suspicious is displayed when highest signal detected is medium. This corresponds to: partial match on employees or company, partial/exact match on brands or business partners, ****dangerous attachments.

Red

A Red banner - Very Suspicious is displayed in case of exact identity match on employee or company. The attacker is pretending to be a known collaborator or the company itself with precision.

Neutral

A Neutral banner will be displayed on all emails when setting neutral_banner_enabled is enabled. Internal emails are also affected. It will display as a single report button on the top right of the email.

Banner actions

In order to effectively report or safelist an email via banner, user should be authenticated.

IMPORTANT: Marking an email as suspicious does not delete it from user mailboxes or block the sender. These actions must be performed manually through your existing security tools (e.g. Exchange, Microsoft Defender).

Mark as safe

Mark as safe button is displayed on all banners by default. It may be removed from all future banners by suppor team

When a user marks an email as safe, the user will never receive banners on future emails from that sender.

After clicking mark as safe, user is auhtenticated on Mantra, and sees a confirmation page

An admin cannot revert “mark as safe” action from user. 

All senders marked as safe by users are logged in Smart Banners Setup - Senders marked as safe by users.

Admin can take the following action:

• Search by sender or sort by most safelisted sender.

• Allow sender for the entire company by clicking the sender icon👤

  

• Allow domain for the entire company by clicking the domain icon @

  

• Perform action in bulk by selecting multiple senders.

  

One admin safelists a sender/domain, it is removed from the table and added into Smart Banners Setup - Preference (Safelist).

When a user marks an email as safe, the user will never receive banners on future emails from that sender.

After clicking mark as safe, user is auhtenticated on LibraCyber, and sees a confirmation page

Report Button in banners

Report button - banners is displayed on all banners by default. 

It may be hidden from all future banners by support team.

When a user reports an email:

• Email is considered a threat and follows Threats flow.

Banner Language

Smart Banners are displayed according to the following language priority order:

1. Language selected by the user in LibraCyber (My Progress page).
2. User's preferred language in Active Directory (PreferredLanguage attribute).
3. Default company language, as configured in LibraCyber.
4. English, as a final fallback if none of the above is available.

Language logic

Language selected by user in LibraCyber (My progress)> 2. User preferred language in AD > 3. Default company language > English (fallback) 

In urgent cases, a CSV file can be provided to LibraCyber to force a language update ahead of schedule — though this approach is not recommended as a routine practice.

⚠️ Important: Before proceeding with any manual update, ensure that Daily User Provisioning is disabled. If active, the next provisioning cycle will automatically overwrite any manually applied changes, reverting users to their previous language settings.