How a trial runs
Day 0
Decide where xorlab runs
Two deployment options, you get the same results for both:- xorlab SaaS — hosted and operated by xorlab. Nothing to provision, so it is the quickest way into a trial.
- On-premises — you run the xorlab Control Center (XCC) and one or more xorlab MTAs on your own virtual infrastructure.
Day 1
Ask for an instance
Write to sales@xorlab.com. Your own trial instance can be ready as early as the next working day.Day 1
Connect your email flow
You choose how far into the mail flow xorlab goes. Both options are reversible in minutes, and neither touches your MX records:- Monitoring Mode — xorlab receives a copy of every email as an additional BCC recipient and drops it after the analysis.
- Inline Mode — xorlab sits in the mail flow but delivers every email anyway, including the ones it would have quarantined.
Day 1–2 on M365
Finish the learning phase
The Relationship model and Local Reputation have to observe your traffic before detection can rely on them. On M365 xorlab bootstraps the process by importing the past months of email from the mailboxes and analyzes them. The import runs before you connect the mail flow. Without M365, expect the models to start settling in after some days.Once it has learned
See what is getting through
xorlab assigns a verdict and a confidence to every email, and assigns categories to the malicious ones: Phishing, Malware, BEC, VIP Fraud, Impersonation, Extortion, Spam, etc. are separate verdicts you can filter and count. Because nothing is blocked yet, each one is a message that reached the mailbox regardless of what you run today.For any of them, xorlab shows the indicators and reasoning behind the decision — see Understanding an Email Verdict.Two weeks
Compare it with what you run today
We recommend two weeks of side-by-side traffic: long enough to cover the weekly rhythm of your mail, short enough that the trial does not stall. Compare it either way:- In xorlab — search the traffic, save what you are tracking as a saved search, and export it to work through outside the platform.
- In your SIEM — stream the verdicts and the analysis results extracted over Syslog, then put them next to what your existing controls reported.
Along the way
Tune it to your own risk appetite
You can shift the balance between catching more and flagging less, and correct individual decisions as they come up — see Fix a False Positive and Fix a False Negative.Go live
Switch protection on
When the results convince you, protection is a configuration change rather than a new project. If you ran in Inline Mode, enabling a switch is all it takes, and quarantining is active about a minute later. From Monitoring Mode, you switch to Inline Mode first. Nothing else about the integration changes.Two ways to connect your mail flow
Both let you evaluate on live traffic without blocking anything. The difference is how much of the final setup you have already built by the end of the trial.What the trial does not touch
- Your MX records. On M365, email keeps arriving at Microsoft, which hands it to xorlab and takes it back for delivery.
- Your current filtering. Your existing filters keep running. xorlab is layered on top, which is what makes the comparison possible.
- Your servers, clients and mailboxes. Nothing is installed and nothing is migrated. Reporting uses the button your users already have.
- Your outbound sending identity. On M365, outgoing email still leaves through Microsoft, so SPF and DKIM stay as they are. Same for on-premises.