BlueHook
simulation · training · email threat removalStaff report a suspicious email with one click. We pull it out of every inbox in the district.
Your staff are the target. We train them, and when something slips through we remove the real thing everywhere it landed — read, unread, forwarded or filed.
How it works
From reported to removed, usually before it spreads.
One button in Outlook or Gmail. No forwarding, nothing to remember. We ask whether they clicked or entered a password, without blame.
Headers, links, attachments, sender authentication and reputation. The verdict is evidence-based, not a guess.
We search every mailbox in the district to establish the true blast radius. One report rarely means one recipient.
Quarantine or delete everywhere in one action, reversible if it turns out to be legitimate. The reporter is thanked. Your team is told.
Inside BlueHook
One reported email, start to finish.
Seven minutes on a Tuesday morning. The front office clicks one button; everything after that is us.
I’m stuck in a meeting and need you to pick up four $100 gift cards for a staff appreciation thing today. I’ll reimburse you. Send me the codes when you have them.
The button is in Outlook and Gmail. No forwarding, nothing to remember.
- ×Sender domain is gmail.com, not the district. Display name borrowed from the principal.
- ×Urgency, secrecy and gift cards: the three tells of a payroll-style scam.
- ×Reply-to points at a second mailbox registered 3 days ago.
- ✓Search of every district mailbox: the same message reached 4 other people.
Headers, sender, links, and a search of every mailbox to find the true blast radius.
Read, unread, forwarded or filed. Reversible if it turns out to be legitimate.
| Role | Clicked | Now assigned |
|---|---|---|
| Substitutes | 5 | Spoofed principal |
| Business office | 3 | Bank-detail change |
| Coaches | 2 | Gift-card asks |
| Front office | 1 | Done |
Whoever clicks gets the thirty-second lesson for that exact scam. The student academy runs separately, by grade.
What is included
A complete program, not a single tool.
Active threat manager
A live queue of everything your staff report, triaged and investigated by us, with a full audit trail.
District-wide remediation
Search every mailbox, quarantine or delete in one action, restore instantly if safe, block the sender going forward.
Phishing simulations
Realistic templates written for school roles, scheduled and run for you, with per-user and per-campaign results.
Staff training library
Forty-plus short, plain-English lessons on real district scenarios, with knowledge checks and completion tracking.
Student academy
Age-appropriate digital-safety lessons students actually engage with. Assign by class or grade.
Compliance and reporting
Training completion by staff member, trend reporting, highest-risk users, and board-ready PDF reports.
What you get to keep
Evidence your board and your insurer will accept.
Training records by name
Who completed what, when. Exportable for audits and insurance renewals.
Every action logged
Who did it, when, why, and how many inboxes were affected. Yours to keep.
Reporting for people who are not in IT
Risk down, reporting up, one page a month a superintendent can read.
Questions districts ask
Before you call
Does it work with Google Workspace?
Yes. BlueHook works with both Microsoft 365 and Google Workspace. The report button sits in Outlook or Gmail.
What does my technology team have to do?
Authorize the connection once. After that, nothing is required for the loop to run. They see every alert and can act themselves if they prefer.
How fast is a real threat removed?
Illustratively, minutes from report to removal. Timings are relative, not a contractual commitment.
Can training be assigned to substitutes and new hires?
Yes. Shareable links make onboarding and substitutes simple, and completion is tracked per person.
Get started
Tell us what you are being asked to prove.
An insurance renewal, a state review, a board question. We will tell you which program answers it, or that none of them do. Straight answer, fixed quote, from the engineer who would do the work.
Reply within one business day. No sales sequence, no mailing list.