Learning Mode

Summary

INKY can be configured to run in "Learning Mode." During this time, some special consideration will be given to the fact that INKY was just recently enabled. This includes a learning mode link in INKY's banners (which leads to the Report This Email page). The Report This Email and Details pages also include an added reminder that INKY was newly added and solicits additional feedback.

Setting

1. Navigate to your INKY Dashboard

2. Select Settings > Analysis

3. Select either “Enable for 1 week” or “Enable for 2 weeks”

4. When making any changes to the Settings page, please ensure that you scroll to the bottom and click on the “Save Changes” button.

Open

Details

An INKY deployment typically starts off operating in a so-called “Learning Mode.” This is a period of 1 week to 2 weeks, during which the user is given extra cues to help tune the INKY algorithms by providing additional feedback through the “Report This Email” functionality. The resulting reports, as always, will be available to administrators in the INKY Admin Console, where they may Allow List, Block List, or configure INKY in other ways.

The most noticeable user-facing difference in learning mode is an additional link in all INKY banners. The default link says “INKY is learning...” which can be customized, and has a target URL identical to the Report This Email link. The central idea for Learning Mode is if the user sees an INKY result in the banner that they disagree with or have a question about, they may be inclined to click this special link to see what it means that “INKY is learning.” This may also reassure the user that INKY could potentially handle the same message better in the future after some additional learning or after the user’s explicit feedback.

The other noticeable artifacts of Learning Mode are on the Report This Email and Details pages. In addition to the normal content on these pages, a special call-out box reminds the user that “INKY was recently added to your mail, so INKY is still learning about your mail environment. Please provide feedback using the button below.”

While not enabled by default, INKY also supports the ability to explicitly suppress specific types of results in learning mode. The results would not show up in banners, but they would be visible on the Details page, and in the INKY Admin Console for administrators to review. For example, if a team knows they use many third-party mail senders for cloud services, newsletters, printers or other devices, INKY may produce spurious “Spoofed Internal Sender” warnings until these senders are added to the Allow List, or added to the team’s policy settings. In this case, learning mode could be extended to hide these types of warnings from end users but make them visible in the console for admins to review and handle appropriately. Then, when the team exits learning mode, users would start seeing Spoofed Internal Sender messages, but only for real threats that need to be blocked. In most cases, this extra result suppression is not necessary, though.

In summary, INKY’s learning mode enables increased communication and interaction with end users to provide extra reassurance that INKY will improve over time, and also increase the likelihood of user feedback to guide administrators in adding any appropriate Allow Lists or policy changes to help INKY be as effective as possible in protecting users from advanced email threats.