Refusing the black box — why every verdict ships with its reasoning
Here is a moment every security team knows. A tool flags an email as malicious. The analyst looks at the alert and asks the only useful question — why? — and the tool has no answer beyond a score. So the analyst investigates the email from scratch, by hand, to decide whether to trust a verdict that was supposed to save them the work.
We decided early that WhiteMail would not do this. It shaped the whole product.
Why the black box persists
Most detection systems output a conclusion without the reasoning: "this is malicious," a number, maybe a category. The reasoning either does not exist in a readable form, or it is considered an implementation detail.
The industry's answer was Explainable AI: surface the top features, show which signals contributed to the score. That is better than nothing. But a list of weighted features is not an investigation. It tells you what the model looked at, not what is actually going on with this email. An analyst still cannot hand it to a colleague, or to an executive, as the account of what happened.
What we built instead
Because WhiteHat is structured as specialists plus an orchestrator, the reasoning is not reconstructed after the fact — it is the decision. For every verdict you can see:
- How the email was analyzed — each agent's score and the specific signals it raised (a Reply-To mismatch, a failed SPF, a look-alike domain, an urgent-transfer ask).
- What context was considered — sender history and the relationship the message leans on.
- The path to the conclusion — a plain-language narrative, written in both Korean and English, that reads like an analyst's case note rather than a debug log.
The narrative being bilingual is not a localization checkbox. A verdict has to be trusted by the SOC analyst, the finance manager who got the email, and the executive who signs off on the response — and in the teams we are building for, those people do not all work in the same language. The explanation has to be first-class in each.
The principle underneath
The shift is from "trust the system" to "see how the system decided." When the reasoning travels with the verdict, three things follow: trust goes up, false positives get resolved in seconds instead of re-investigated, and the response is consistent because everyone is reading the same account.
A verdict you cannot see through is one you will redo. So we made the investigation the thing we ship. The verdict is just its headline.
Open any result in the Analyze console to read the full per-agent reasoning behind it.