Hoxhunt now classifies emails reported by your employees as safe when assessed with 99%+ confidence. When you enable safe classification, it resolves most reported emails automatically and sends employees an instant verdict. Analysts see only the reports that need real attention.
How this reduces analyst workload
- Most reported emails resolve without reaching the analyst queue. The majority of employee reports are benign emails: newsletters, IT announcements, known vendor messages. With safe classification enabled, these resolve automatically.
- No analyst time spent on confirmed safe reports. Safe emails do not appear in the triage queue. Your team focuses on reports that are genuinely suspicious or malicious.
- Employees get a clear verdict. Every employee who reports a safe email receives instant feedback: "This email is safe to interact with." Reporting volume stays strong because reporters get an answer, not silence.
What the safe verdict is based on
Hoxhunt Respond classifies every reported email into one of four verdicts: Malicious, Likely malicious, Possibly malicious, and Safe. The safe verdict is new.
Before safe classification, emails assessed as benign received a "possibly malicious" verdict and entered the analyst queue. Only malicious emails resolved automatically: roughly one out of five of all reports. The remaining required manual analyst review.
Now, emails assessed with high confidence to be safe receive a safe verdict and resolve automatically. Automated coverage expands to cover most reported emails. Analysts see only reports with genuine suspicion or a confirmed threat.
Hoxhunt's threat analysis model powers the safe verdict. Hoxhunt validated it against millions of reported emails, comparing results to human analyst verdicts. Accuracy on safe classifications: 99%+.
The safe verdict appears in two places:
- Instant Feedback: employees who reported the email receive a notification: "This email is safe to interact with."
- Incident Orchestration: safe reports resolve automatically and do not appear in the analyst queue.
September 2026 update: reported safe mail stays in the inbox
A reported email that Hoxhunt classifies as safe now stays in the employee's inbox. Before this update it was moved to their Deleted Items folder.
This is the default for every organization with safe classification enabled. No admin action is required and no setting changes.
When Hoxhunt tells an employee an email is safe to interact with, leaving the email where they found it matches that answer. Employees keep the newsletter, vendor notice, or internal message they reported instead of retrieving it from Deleted Items.
Where safe mail stays in the inbox
| Reporting path | Where a safe email ends up |
|---|---|
| Gmail | Stays in the inbox |
| Outlook on Microsoft Graph | Stays in the inbox |
| Outlook on REST or EWS | Moved to Deleted Items |
| SMTP reporting, Teams reporting | Moved to Deleted Items |
Limitations
- Safe classification is off by default. An admin must turn it on in product settings.
- Safe mail stays in the inbox on Gmail and on Outlook via Microsoft Graph. On Outlook via REST or EWS, and for SMTP and Teams reporting, a safe email is moved to the end user's Deleted Items folder instead.
- Available to customers with Incident Orchestration or Instant Feedback.
- Safe verdicts carry 99%+ accuracy, not 100%. A small proportion of safe reports may be miscategorised.
Actions needed from you
Toggle safe classification on in your admin settings.
- Sign in to the admin console and open Response > Threat settings.
- Toggle safe classification on.
Note: Analyst triage volume will drop significantly once enabled. Notify your security team before the queue shrinks.
No action is required for the September 2026 update. It applies automatically to every organization that already has safe classification on.