Taking the Next Step: Building My Own Business in Email Security

For those who know me, this probably will not come as a complete surprise. For everyone else, it is time to introduce what I have been working on, why I am doing it, and where I intend to take it.

I have spent a substantial part of my working life dealing with email, spam, abuse, and the infrastructure that keeps the internet’s messaging systems running. I founded and ran SORBS, one of the long-running anti-spam blocklists, and I have spent years working on the problems that mail operators, service providers, businesses, and their customers face every day.

Now, I am taking the next step. I have established my own business, built a suite of products, and started bringing them to market.

In the words I would probably use in conversation, I’m going to give it a crack.

Why build something of my own?

Email remains one of the most important communication systems in the world, but the way we secure and operate it has changed considerably.

Much of the industry has moved towards cloud services, per-mailbox subscriptions, and platforms where the provider controls both the infrastructure and the rules. For some organisations, that is a perfectly reasonable choice. For others, it creates problems around cost, control, data sovereignty, flexibility, and dependence on a third party.

There are still internet service providers, carriers, mail hosting companies, managed service providers, and businesses that want to operate their own infrastructure. Some need to support legacy systems. Others want to move away from Microsoft 365 or Google Workspace, or simply want more control over how their mail is handled.

I believe there is room for a different approach.

My aim is to build practical, effective email infrastructure and security products that organisations can run on their own systems, under their own control, without having to surrender their mail or their data to another company’s cloud.

This is not about reinventing email for the sake of it. It is about solving real problems, using the experience I have accumulated over many years, and making the resulting solutions available to other people who need them.

What I have been building

The product suite is available through misullivan.com. It brings together several complementary technologies, each addressing a different part of the email security and infrastructure problem.

Scorpion: The mail protocol proxy

Scorpion Proxy provides a single entry point between mail clients and the servers that actually hold their mail.

It is designed to simplify complex mail environments, allowing back-end servers to be moved, replaced, or expanded without requiring the same changes to every client. It can also provide modern TLS connections and IPv6 access to older systems that do not support those capabilities themselves.

Scorpion is also the integration point for click-time URL protection, bringing another layer of security into the mail access path.

The idea is straightforward: make the infrastructure behind the service easier to manage, while improving what users experience at the front end.

PDMSC: A different approach to spam classification

Spam filtering has always involved a balance between stopping unwanted mail and ensuring legitimate messages get through.

My approach with PDMSC is to use multiple classification models arranged in stages. The inexpensive, precise stages get the first opportunity to classify a message, while more complex stages deal with the messages that need additional analysis.

This allows the system to make decisions efficiently without subjecting every message to the most expensive processing available.

It is the result of years of experience with spam classification, combined with a continuing interest in how we can improve accuracy and performance without making the infrastructure unnecessarily complicated.

INTENT2: Understanding what a message is trying to do

Not every suspicious message can be identified by looking at its technical characteristics or assigning it a conventional spam score.

Sometimes, the important question is what the message is actually trying to persuade the recipient to do.

INTENT2 adds a local language model to the classification process for messages that need this deeper level of interpretation. It runs on the operator’s own infrastructure rather than sending message content to an external AI service.

The intention is to add another useful layer of judgement without turning every message into a lengthy conversation with a remote model.

MISUIC: Looking beyond the URL

A link can look convincing, and a webpage can even appear to be exactly what its author claims it is. That does not mean the website belongs to the organisation it is impersonating.

MISUIC, the Michelle I. Sullivan URI Classifier, examines the intent and structure of URLs, including whether a domain has the right to represent the brand it claims to represent.

This matters because a link can be new, previously unreported, or deliberately constructed to evade conventional reputation-based checks.

MISUIC is designed to make useful judgements quickly, using deterministic rules first and reputation information as corroborating evidence. It provides another way to identify suspicious links before they become a problem for the recipient.

SURIBS: Making domain reputation useful

SURIBS provides hostname and domain reputation intelligence that complements the classification systems.

It brings together information about known and suspected malicious hosts, including phishing infrastructure, malware distribution, and brand impersonation. The service includes a free public DNS-based blocklist, as well as licensed services for organisations that need more control over how reputation information is used.

The important distinction is that reputation and classification work together. A reputation list is valuable, but it cannot know everything about every new domain. Structural analysis can identify problems that have never been reported, while reputation information adds useful historical evidence.

Together, these approaches provide a stronger foundation than relying on either one alone.

Why keep it on your own infrastructure?

One of the common threads running through these products is that they are designed to operate within the organisation’s own environment.

That means organisations can retain control over their mail, their data, and their security decisions. It also means they are not necessarily required to buy into an entire cloud platform just to obtain a particular security capability.

The software is designed to run across a range of environments, from modern servers and virtual machines to smaller hardware and older operating systems where appropriate.

For operators with sovereignty requirements, that flexibility matters. For providers managing large numbers of mailboxes, it can also make a difference to operating costs and the ability to control their own service.

I am not suggesting that every organisation should abandon cloud services. I am suggesting that organisations should have credible alternatives, and that those alternatives should be technically sound, commercially viable, and capable of doing the job properly.

Built from experience, tested in production

I have not approached this as a theoretical exercise.

The core components are already in production, and I have been measuring their behaviour under real operating conditions. The figures published on the main website include results from a 5,030-message holdout set, with 98.88 per cent of spam caught, no legitimate mail lost across 4,953 known-good messages, and a median scan time of 58 milliseconds on the measured production system.

Those figures are specific to the stated test conditions, and I want to keep it that way. Performance claims are only useful when people can understand what was measured, how it was measured, and what the results actually mean.

I would rather show the evidence, explain the limitations, and let prospective customers evaluate the technology against their own requirements than make sweeping promises that cannot be substantiated.

That is also why the technical documentation and explanations are being published openly. I want people to understand how the products work, not simply be asked to trust a marketing statement.

Who am I looking to work with?

I am particularly interested in talking to organisations that operate their own mail infrastructure or provide mail services to other people.

That includes:

• Internet service providers, carriers, and mail hosting providers.
• Managed service providers looking for more control over their filtering and infrastructure costs.
• Businesses that want to operate their own email systems rather than depend entirely on a large cloud platform.
• Organisations with data sovereignty, privacy, or regulatory requirements that make sending mail through an external security provider undesirable.
• Technical teams looking to improve spam filtering, phishing protection, URL security, or the management of existing mail infrastructure.

I am also interested in working with a small number of design partners who are willing to evaluate the products alongside their existing systems.

A pilot does not have to mean ripping out an existing installation and hoping for the best. Where appropriate, the classification components can be introduced in an observation-only configuration, allowing operators to assess the results before enabling enforcement.

I want these products to solve actual operational problems, so conversations with people who understand those problems are valuable to me.

This is the beginning, not the finish line

Launching a business is a different challenge from building software.

There is product development, documentation, support, licensing, commercial relationships, and all the other work required to turn a collection of working technologies into a sustainable business. I am under no illusion that the technical work is the only part that matters.

But I have built the technology, I know the problems it is intended to solve, and I believe there is a market for solutions that put control back into the hands of the people operating the service.

I have an ABN, an ACN, a growing product suite, and a clear direction. Now it is time to take the next step and find the organisations that can benefit from what I have built.

If you work for an ISP, a carrier, a mail provider, or a business that is looking for a different approach to email security, I would genuinely like to hear from you. If you are a consultant working with those organisations, I would welcome a conversation with you, too.

You can explore the products and technical details at misullivan.com, or get in touch directly at enquiries@misullivan.com.

I have spent a lot of years working on email and abuse prevention. Now I am putting that experience into my own business, with products that I believe can make a practical difference.

Let’s see where it goes.