The short version
These tools are free. They are research artifacts and educational resources, not a commercial product. Use them on domains you own or have explicit permission to assess. By using the tools you agree to these terms.
1. Who is providing these tools
These tools are operated by StrongestLayer Inc., the email security vendor at strongestlayer.com. The free-tools hub at strongestlayer.org is published by our threat research team as a community resource. Same team, separate surfaces, on purpose.
2. What you can do
- Run the Corporate Email Posture Check on any domain you own or have explicit written permission to assess.
- Browse the Email Attack Taxonomy, simulator walkthroughs, and reference frameworks.
- Share the report with internal stakeholders inside your organization.
- Cite the taxonomy, scoring methodology, and findings in research, presentations, or training materials with attribution to StrongestLayer Threat Research.
3. What you cannot do
- Run checks on domains you do not own or have authorization to assess. Doing so may violate applicable computer-misuse laws in your jurisdiction.
- Submit a third party's email address as the recipient without their consent.
- Attempt to bypass rate limits, scrape the API, or automate submissions outside the request form.
- Reverse-engineer, copy, or redistribute the worker code or data files.
- Use the tools to harass, defame, or harm any organization or individual.
- Misrepresent the report findings or claim StrongestLayer endorses or has direct knowledge of any specific organization beyond what the public-source analysis surfaced.
4. Nature of the analysis
The Corporate Email Posture Check is generated by AI agents querying public web sources. It is not a penetration test, vulnerability assessment, or security audit. The findings are a point-in-time snapshot of public OSINT exposure, scored against a research framework. Treat the report as a starting point for your own investigation, not a final assessment. We do not connect to your mail tenant, internal systems, or private data.
5. Accuracy
We make best-effort use of multi-source web search, anti-fabrication prompting, and domain-specific scoring to produce reliable findings. Findings can still be wrong, incomplete, or misinterpret context. The MX-based stack fingerprint identifies the gateway but cannot detect post-delivery layers (ICES platforms like Abnormal, Material, Sublime, IRONSCALES). Use your judgment.
6. No warranty
The tools are provided as is without warranty of any kind, express or implied, including but not limited to merchantability, fitness for a particular purpose, or non-infringement. We do not guarantee uptime, accuracy, or that the service will be available indefinitely.
7. Limitation of liability
To the maximum extent permitted by law, StrongestLayer is not liable for any indirect, incidental, consequential, special, or punitive damages arising from your use of the tools, including but not limited to loss of profits, data, goodwill, or business interruption, even if we were advised of the possibility of such damages. Direct damages are capped at the amount you paid for the tools, which is zero.
8. Rate limits and abuse prevention
One check per work email per 7-day window. Free email providers blocked at submission. We may, at our sole discretion, additionally rate-limit, block, or revoke access from any individual or organization that abuses the service.
9. Privacy
Your submission and report data are handled per our Privacy Policy. We do not sell your data and do not train AI models on what you submit.
10. Intellectual property
The Corporate PDA Framework (formally the Corporate Public Data Attack-Surface methodology), the 44-subtype Email Attack Taxonomy, the simulator content, and all StrongestLayer brand elements are the intellectual property of StrongestLayer. The scoring methodology and category structure are research artifacts you may cite with attribution. The brand, logos, and proprietary content cannot be redistributed without permission.
11. Modifications
We may modify these terms at any time. The Last Updated date at the top reflects the most recent change. Continued use of the tools after a change indicates acceptance.
12. Governing law
These terms are governed by the laws of the State of Delaware, United States, without regard to conflict-of-laws principles. Any dispute will be resolved in the state or federal courts located in Delaware.
13. Contact
Questions or to report abuse: info@strongestlayer.org.