Why is there a coloured bar at the top of my email?

Northstar IT email protection is a behavioural email security service that uses machine learning and artificial intelligence to analyze incoming messages for signs of phishing, spam, and other email-based threats. It runs quietly behind your existing Microsoft 365 or Google Workspace mailbox.

The colour-coded banners are inserted by Northstar IT to alert you to anything unusual about a message. The banners may show up on any email, whether it is internal (from someone in your organisation) or external. If you are seeing them, your IT team has deployed Northstar IT email protection and included you in the group of protected users.

Gray A gray banner means nothing unusual or suspicious was found about the message. Even so, you should always check the displayed sender address and source. For example, a personal webmail address claiming to be a colleague is still worth a second look.

Yellow A yellow banner means something unusual was found about the email. It is not necessarily phishing, but it is worth paying attention to. Requests for sensitive personal or financial information, or messages that just feel out of the ordinary, often get a yellow banner.

Red A red banner means the message is likely phishing or otherwise dangerous. This includes brand impersonations (such as a fake account alert from your IT department), known phishing URLs, or attempts to make mail look like it came from inside your own organisation.

Look carefully at who the mail is from and whether you actually trust the sender. Be especially careful about clicking any links in the body of the email or opening any attachments. When in doubt, click Report This Email in the banner and we will review it for you.

In most cases you can simply delete the message and move on. In many Northstar IT deployments, your mail server is configured to quarantine or delete red-flagged mail before it ever reaches your inbox. In other cases, the message is still delivered with a banner telling you to be careful so you can see the threat and learn to recognise it.

Never click links or open attachments in a red banner email. If you are unsure, use Report This Email and our team will investigate.

Clicking Report This Email sends the message to the Northstar IT security team for analysis. It works from any device, including your phone. The information is used to improve detection across all our protected clients, and our team will follow up directly if the message turns out to be a real threat.

Every link in a protected email is rewritten so that we can check it again at the moment you click. If the destination has turned malicious since the email arrived, you will be shown a Northstar IT warning page instead of the dangerous site. This is the same real-time protection that catches links which were safe when delivered but later got compromised.

Please reach out to your internal IT contact, or contact Northstar IT directly. We can fine-tune your banner text, policies, and reporting workflow so it fits how your team actually works.

Email keegan@northstarit.ca or call 672-983-1174.

Read the Protection by Northstar IT overview for a tour of what we block and how the banners work, or visit our cybersecurity hub for our full managed security lineup.