--- title: AI Email Classification in SecurityGateway™ helps businesses distinguish between phishing & legitimate email description: How to use AI email classification in SecurityGateway for Email - to distinguish phishing & bulk email from legitimate email. Learn more at www.mdaemon.com. image: https://blog.mdaemon.com/hubfs/AI-Email-Classification_SecurityGateway.jpg --- [![MDaemon Technologies](https://blog.mdaemon.com/hs-fs/hubfs/MDaemon-Technologies_logo_large.png?width=564&height=110&name=MDaemon-Technologies_logo_large.png "MDaemon Technologies")](https://mdaemon.com/) - [Blog Home](https://blog.mdaemon.com) # MDaemon Technologies Blog ## [AI Email Classification in SecurityGateway™ helps businesses distinguish between phishing & legitimate email](https://blog.mdaemon.com/ai-email-classification-in-securitygateway-for-email) By [Brad Wyro](https://blog.mdaemon.com/author/brad-wyro) - [Tweet](https://twitter.com/share) SecurityGateway includes AI email classification for stronger protection against email-borne threats. AI email classification is a threat detection feature that uses artificial intelligence to analyze message content and classify messages as spam, phishing, commercial, containing personally identifiable information, or legitimate. You can then set rules to determine which messages will be analyzed and what actions will be taken (such as reject, quarantine, or add to the message’s spam score) based on the resulting AI classification. The benefits of using AI email classification include: - **Advanced Threat Detection** to Identify sophisticated phishing attempts that traditional filters might miss. - **Sensitive Content Identification** to detect messages containing Personally Identifiable Information (PII) or other sensitive data. - And **Improved filtering** with greater accuracy. Watch our video to learn more about how to configure AI email classification in SecurityGateway. # **How AI Email Classification Works** To understand how AI email classification works, it’s helpful to understand these three concepts: AI models, prompts, and rules. ## **AI Models** An AI model is a process that uses artificial intelligence techniques such as machine learning or deep learning, to perform tasks that typically require human intelligence. These tasks include understanding natural language, recognizing images, and making predictions. AI models are trained on large datasets and can learn patterns, relationships, and decision-making processes to perform these tasks autonomously. ## **Prompts** An AI prompt is a specific instruction, question, or piece of text that is passed to your selected AI model to guide its behavior and generate a desired output. It's essentially a way to communicate with the AI service and tell it what you want it to do. ### **Rules** Rules allow you to specify which email messages you’d like to analyze, and what actions you’d like to take, such as quarantine or reject, based on analysis results. #### **How to Use AI Email Classification in SecurityGateway** The steps to implement AI email classification in SecurityGateway are: 1. Add an AI model to query 2. Configure AI prompts 3. Define rules to determine which messages to analyze & what actions to take based on analysis results ##### **Step 1: Add an AI model to query** The first step is to define an [AI model](https://help.mdaemon.com/SecurityGateway/en/ai_model_list.html) to query. You have four AI models to choose from: **OpenAI/ChatGPT** \- Gpt-4.1-mini may provide a good balance of performance and cost for general tasks - GPT4.1 is more powerful and, while it may be better for complex analysis, it may incur higher costs  **Google Gemini** \- Designed for speed and accuracy **Local** -  Use if you prefer not to send data to a third-party provider **Custom** **![AI\_Models\_Security-Gateway](https://blog.mdaemon.com/hs-fs/hubfs/AI_Models_Security-Gateway.png?width=976&height=516&name=AI_Models_Security-Gateway.png)** ##### **Step 2: Configure Prompts** The next step in configuring AI classification in SecurityGateway is to configure prompts. An [AI prompt](https://help.mdaemon.com/SecurityGateway/en/ai_prompt_list.html) is a specific instruction, question, or block of text that is passed to your selected AI model to guide its behavior and generate a desired output. As I mentioned above, it allows you to communicate with the AI service and tell it what you want it to do. This prompt will request the AI model to return one of the allowed classification labels specified - for example LEGITIMATE, UNSOLICITED, COMMERCIAL, PHISHING, OR HIPAA, among others. ![AI\_Prompts\_Security-Gateway](https://blog.mdaemon.com/hs-fs/hubfs/AI_Prompts_Security-Gateway.png?width=984&height=517&name=AI_Prompts_Security-Gateway.png) ##### **Step 3: Define Rules** The next step is to define [AI Rules](https://help.mdaemon.com/SecurityGateway/en/ai_rule_list.html) to specify which email messages you’d like to analyze, and what actions you’d like to take, such as quarantine or reject, based on the results of the email classification process. For example, you could choose to use AI Classification only for messages addressed to certain users, such as those whom you think may be most vulnerable to phishing attempts. ![AI\_Rules\_Security-Gateway](https://blog.mdaemon.com/hs-fs/hubfs/AI_Rules_Security-Gateway.png?width=984&height=516&name=AI_Rules_Security-Gateway.png) ##### **Cost & Testing Considerations** Because data is passed to a third-party provider, cost is a valid concern when using cloud-based AI models, therefore you should test various models to see which would work best for you. - OpenAI may offer a certain number of free tokens for new accounts. For more extensive testing or if you agree to their data usage policies (which might involve allowing them to use your data for training purposes), you might find options for reduced-cost or free testing. - Google Cloud AI, when used with a free Google Cloud account, often provides a limited number of free requests as part of their free tier, which can be useful for initial testing and familiarization. To avoid any unexpected costs, always review the current terms of service for any AI provider. AI email classification is one of many security features found in SecurityGateway. Whether you’re using Microsoft 365, Microsoft Exchange, MDaemon, or any other email service, SecurityGateway can help protect your business from email-borne threats. [Click here](https://mdaemon.com/pages/downloads-security-gateway-free-trial) to download your free trial!   Tags: [Email Security](https://blog.mdaemon.com/topic/email-security), [Stop Spam Email](https://blog.mdaemon.com/topic/stop-spam-email), [Email Security Best Practices](https://blog.mdaemon.com/topic/email-security-best-practices) ![Brad Wyro](https://blog.mdaemon.com/hs-fs/hubfs/Brad-2023v2.jpg?width=100&height=100&name=Brad-2023v2.jpg) #### Written by [Brad Wyro](https://blog.mdaemon.com/author/brad-wyro) Brad has worked in technical and marketing roles at MDaemon Technologies, where he contributes as Content Marketing Manager. Brad balances technical and creative information to develop easy to understand videos and content to educate prospects and customers. [![BACK TO ALL ARTICLES](https://hubspot-no-cache-na2-prod.s3.amazonaws.com/cta/default/6572702/05b24dbb-70a6-4eaa-9507-321cb27f7228.png)](https://hubspot-cta-redirect-na2-prod.s3.amazonaws.com/cta/redirect/6572702/05b24dbb-70a6-4eaa-9507-321cb27f7228) ### Subscribe to Email Updates - [Popular](https://blog.mdaemon.com/ai-email-classification-in-securitygateway-for-email#tab-2) - [Recent](https://blog.mdaemon.com/ai-email-classification-in-securitygateway-for-email#tab-1) - [Categories](https://blog.mdaemon.com/ai-email-classification-in-securitygateway-for-email#tab-3) ### Lists by Topic - [Email Security (73)](https://blog.mdaemon.com/tag/email-security) - [MDaemon Email Server (45)](https://blog.mdaemon.com/tag/mdaemon-email-server) - [Email How To (38)](https://blog.mdaemon.com/tag/email-how-to) - [Email Best Practices (29)](https://blog.mdaemon.com/tag/email-best-practices) - [Phishing (28)](https://blog.mdaemon.com/tag/phishing) - [Product Updates (28)](https://blog.mdaemon.com/tag/product-updates) - [Security Gateway for Email (27)](https://blog.mdaemon.com/tag/security-gateway-for-email) - [Stop Spam Email (25)](https://blog.mdaemon.com/tag/stop-spam-email) - [Cybersecurity (24)](https://blog.mdaemon.com/tag/cybersecurity) - [Email Security Best Practices (23)](https://blog.mdaemon.com/tag/email-security-best-practices) - [Email Server (22)](https://blog.mdaemon.com/tag/email-server) - [Two-Factor Authentication (18)](https://blog.mdaemon.com/tag/two-factor-authentication) - [Email Gateway How-To (17)](https://blog.mdaemon.com/tag/email-gateway-how-to) - [Email Security Trends (15)](https://blog.mdaemon.com/tag/email-security-trends) - [SecurityGateway (13)](https://blog.mdaemon.com/tag/securitygateway) - [Health Care Security (12)](https://blog.mdaemon.com/tag/health-care-security) - [Spear Phishing (12)](https://blog.mdaemon.com/tag/spear-phishing) - [Data Leak Prevention (11)](https://blog.mdaemon.com/tag/data-leak-prevention) - [Email Encryption (11)](https://blog.mdaemon.com/tag/email-encryption) - [Anti-Spoofing (10)](https://blog.mdaemon.com/tag/anti-spoofing) - [MDaemon Webmail (10)](https://blog.mdaemon.com/tag/mdaemon-webmail) - [Email Archiving (8)](https://blog.mdaemon.com/tag/email-archiving) - [Email Management (8)](https://blog.mdaemon.com/tag/email-management) - [Email Privacy (8)](https://blog.mdaemon.com/tag/email-privacy) - [Email Spoofing (8)](https://blog.mdaemon.com/tag/email-spoofing) - [Business Email Compromise (7)](https://blog.mdaemon.com/tag/business-email-compromise) - [Tutorial (7)](https://blog.mdaemon.com/tag/tutorial) - [Anti-Virus (6)](https://blog.mdaemon.com/tag/anti-virus) - [Collaboration (6)](https://blog.mdaemon.com/tag/collaboration) - [Email Software (6)](https://blog.mdaemon.com/tag/email-software) - [Update (6)](https://blog.mdaemon.com/tag/update) - [Email Authentication (5)](https://blog.mdaemon.com/tag/email-authentication) - [Compliance (4)](https://blog.mdaemon.com/tag/compliance) - [Email Remote Administration (4)](https://blog.mdaemon.com/tag/email-remote-administration) - [MailStore Archive Server (4)](https://blog.mdaemon.com/tag/mailstore-archive-server) - [Microsoft 365 Exchange Alternative (4)](https://blog.mdaemon.com/tag/microsoft-365-exchange-alternative) - [Passwords (4)](https://blog.mdaemon.com/tag/passwords) - [Software update (4)](https://blog.mdaemon.com/tag/software-update) - [Archive (3)](https://blog.mdaemon.com/tag/archive) - [MDaemon (3)](https://blog.mdaemon.com/tag/mdaemon) - [Attachments (2)](https://blog.mdaemon.com/tag/attachments) - [Business Email (2)](https://blog.mdaemon.com/tag/business-email) - [Cloud (2)](https://blog.mdaemon.com/tag/cloud) - [DMARC (2)](https://blog.mdaemon.com/tag/dmarc) - [Email Collaboration (2)](https://blog.mdaemon.com/tag/email-collaboration) - [Industry Insight (2)](https://blog.mdaemon.com/tag/industry-insight) - [insider threats (2)](https://blog.mdaemon.com/tag/insider-threats) - [msp (2)](https://blog.mdaemon.com/tag/msp) - [Anti-Relay (1)](https://blog.mdaemon.com/tag/anti-relay) - [BEC (1)](https://blog.mdaemon.com/tag/bec) - [Backscatter (1)](https://blog.mdaemon.com/tag/backscatter) - [Bayesian Learning (1)](https://blog.mdaemon.com/tag/bayesian-learning) - [Content Filter (1)](https://blog.mdaemon.com/tag/content-filter) - [DNS-BL (1)](https://blog.mdaemon.com/tag/dns-bl) - [Disaster Recovery (1)](https://blog.mdaemon.com/tag/disaster-recovery) - [Email Software Reviews (1)](https://blog.mdaemon.com/tag/email-software-reviews) - [Encrypt (1)](https://blog.mdaemon.com/tag/encrypt) - [External Email Threats (1)](https://blog.mdaemon.com/tag/external-email-threats) - [Gateway (1)](https://blog.mdaemon.com/tag/gateway) - [Inbox (1)](https://blog.mdaemon.com/tag/inbox) - [Inbox Zero (1)](https://blog.mdaemon.com/tag/inbox-zero) - [Macros (1)](https://blog.mdaemon.com/tag/macros) - [Monitoring (1)](https://blog.mdaemon.com/tag/monitoring) - [Quarantine (1)](https://blog.mdaemon.com/tag/quarantine) - [RelayFax (1)](https://blog.mdaemon.com/tag/relayfax) - [Software (1)](https://blog.mdaemon.com/tag/software) - [Training (1)](https://blog.mdaemon.com/tag/training) - [Troubleshooting (1)](https://blog.mdaemon.com/tag/troubleshooting) - [Upgrade (1)](https://blog.mdaemon.com/tag/upgrade) - [Web Conferencing (1)](https://blog.mdaemon.com/tag/web-conferencing) - [Windows Server (1)](https://blog.mdaemon.com/tag/windows-server) - [internal email threat (1)](https://blog.mdaemon.com/tag/internal-email-threat) - [ssl (1)](https://blog.mdaemon.com/tag/ssl) - [tax scams (1)](https://blog.mdaemon.com/tag/tax-scams) see all ### Posts by Topic - [Email Security (73)](https://blog.mdaemon.com/tag/email-security) - [MDaemon Email Server (45)](https://blog.mdaemon.com/tag/mdaemon-email-server) - [Email How To (38)](https://blog.mdaemon.com/tag/email-how-to) - [Email Best Practices (29)](https://blog.mdaemon.com/tag/email-best-practices) - [Phishing (28)](https://blog.mdaemon.com/tag/phishing) - [Product Updates (28)](https://blog.mdaemon.com/tag/product-updates) - [Security Gateway for Email (27)](https://blog.mdaemon.com/tag/security-gateway-for-email) - [Stop Spam Email (25)](https://blog.mdaemon.com/tag/stop-spam-email) - [Cybersecurity (24)](https://blog.mdaemon.com/tag/cybersecurity) - [Email Security Best Practices (23)](https://blog.mdaemon.com/tag/email-security-best-practices) - [Email Server (22)](https://blog.mdaemon.com/tag/email-server) - [Two-Factor Authentication (18)](https://blog.mdaemon.com/tag/two-factor-authentication) - [Email Gateway How-To (17)](https://blog.mdaemon.com/tag/email-gateway-how-to) - [Email Security Trends (15)](https://blog.mdaemon.com/tag/email-security-trends) - [SecurityGateway (13)](https://blog.mdaemon.com/tag/securitygateway) - [Health Care Security (12)](https://blog.mdaemon.com/tag/health-care-security) - [Spear Phishing (12)](https://blog.mdaemon.com/tag/spear-phishing) - [Data Leak Prevention (11)](https://blog.mdaemon.com/tag/data-leak-prevention) - [Email Encryption (11)](https://blog.mdaemon.com/tag/email-encryption) - [Anti-Spoofing (10)](https://blog.mdaemon.com/tag/anti-spoofing) - [MDaemon Webmail (10)](https://blog.mdaemon.com/tag/mdaemon-webmail) - [Email Archiving (8)](https://blog.mdaemon.com/tag/email-archiving) - [Email Management (8)](https://blog.mdaemon.com/tag/email-management) - [Email Privacy (8)](https://blog.mdaemon.com/tag/email-privacy) - [Email Spoofing (8)](https://blog.mdaemon.com/tag/email-spoofing) - [Business Email Compromise (7)](https://blog.mdaemon.com/tag/business-email-compromise) - [Tutorial (7)](https://blog.mdaemon.com/tag/tutorial) - [Anti-Virus (6)](https://blog.mdaemon.com/tag/anti-virus) - [Collaboration (6)](https://blog.mdaemon.com/tag/collaboration) - [Email Software (6)](https://blog.mdaemon.com/tag/email-software) - [Update (6)](https://blog.mdaemon.com/tag/update) - [Email Authentication (5)](https://blog.mdaemon.com/tag/email-authentication) - [Compliance (4)](https://blog.mdaemon.com/tag/compliance) - [Email Remote Administration (4)](https://blog.mdaemon.com/tag/email-remote-administration) - [MailStore Archive Server (4)](https://blog.mdaemon.com/tag/mailstore-archive-server) - [Microsoft 365 Exchange Alternative (4)](https://blog.mdaemon.com/tag/microsoft-365-exchange-alternative) - [Passwords (4)](https://blog.mdaemon.com/tag/passwords) - [Software update (4)](https://blog.mdaemon.com/tag/software-update) - [Archive (3)](https://blog.mdaemon.com/tag/archive) - [MDaemon (3)](https://blog.mdaemon.com/tag/mdaemon) - [Attachments (2)](https://blog.mdaemon.com/tag/attachments) - [Business Email (2)](https://blog.mdaemon.com/tag/business-email) - [Cloud (2)](https://blog.mdaemon.com/tag/cloud) - [DMARC (2)](https://blog.mdaemon.com/tag/dmarc) - [Email Collaboration (2)](https://blog.mdaemon.com/tag/email-collaboration) - [Industry Insight (2)](https://blog.mdaemon.com/tag/industry-insight) - [insider threats (2)](https://blog.mdaemon.com/tag/insider-threats) - [msp (2)](https://blog.mdaemon.com/tag/msp) - [Anti-Relay (1)](https://blog.mdaemon.com/tag/anti-relay) - [BEC (1)](https://blog.mdaemon.com/tag/bec) - [Backscatter (1)](https://blog.mdaemon.com/tag/backscatter) - [Bayesian Learning (1)](https://blog.mdaemon.com/tag/bayesian-learning) - [Content Filter (1)](https://blog.mdaemon.com/tag/content-filter) - [DNS-BL (1)](https://blog.mdaemon.com/tag/dns-bl) - [Disaster Recovery (1)](https://blog.mdaemon.com/tag/disaster-recovery) - [Email Software Reviews (1)](https://blog.mdaemon.com/tag/email-software-reviews) - [Encrypt (1)](https://blog.mdaemon.com/tag/encrypt) - [External Email Threats (1)](https://blog.mdaemon.com/tag/external-email-threats) - [Gateway (1)](https://blog.mdaemon.com/tag/gateway) - [Inbox (1)](https://blog.mdaemon.com/tag/inbox) - [Inbox Zero (1)](https://blog.mdaemon.com/tag/inbox-zero) - [Macros (1)](https://blog.mdaemon.com/tag/macros) - [Monitoring (1)](https://blog.mdaemon.com/tag/monitoring) - [Quarantine (1)](https://blog.mdaemon.com/tag/quarantine) - [RelayFax (1)](https://blog.mdaemon.com/tag/relayfax) - [Software (1)](https://blog.mdaemon.com/tag/software) - [Training (1)](https://blog.mdaemon.com/tag/training) - [Troubleshooting (1)](https://blog.mdaemon.com/tag/troubleshooting) - [Upgrade (1)](https://blog.mdaemon.com/tag/upgrade) - [Web Conferencing (1)](https://blog.mdaemon.com/tag/web-conferencing) - [Windows Server (1)](https://blog.mdaemon.com/tag/windows-server) - [internal email threat (1)](https://blog.mdaemon.com/tag/internal-email-threat) - [ssl (1)](https://blog.mdaemon.com/tag/ssl) - [tax scams (1)](https://blog.mdaemon.com/tag/tax-scams) See all #### About MDaemon Technologies MDaemon Technologies is a pioneer in developing email and email security software helping to protect customers from evolving cyber-security threats. Its products and services are trusted by thousands of organizations in over 140 countries. For more than two decades, the company’s products have been developed with the ongoing input of IT professionals who demand reliable, affordable software that requires minimal effort to manage. The software can be deployed in virtual, hosted cloud, on-premises, or hybrid network environments. The company sells its software and services directly and through a network of global channel partners. For more information, visit [www.mdaemon.com](https://www.altn.com/). Copyright © 1996-2026 MDaemon Technologies.  View [privacy policy](https://mdaemon.com/policies/privacy-policy).   ###### Contact Us +1.817-601-3222 [sales@help.mdaemon.com](mailto:sales@help.mdaemon.com) 6340 Lake Worth Blvd. Fort Worth, TX 76135 ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Brad Wyro", "url" : "https://blog.mdaemon.com/author/brad-wyro" }, "dateModified" : "2026-07-14T19:08:31.990Z", "datePublished" : "2025-10-06T14:30:34.000Z", "headline" : "AI Email Classification in SecurityGateway™ helps businesses distinguish between phishing & legitimate email", "image" : [ "https://blog.mdaemon.com/hubfs/AI-Email-Classification_SecurityGateway.jpg" ], "mainEntityOfPage" : { "@id" : "https://blog.mdaemon.com/ai-email-classification-in-securitygateway-for-email", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://blog.mdaemon.com/hubfs/MDaemon-Technologies_logo_large.png" }, "name" : "MDaemon Technologies" } } ```