How we built it: the app that gives our analysts more time to fight cyber evil

Expel describes AME, a semi-supervised ML feature that programmatically identifies and auto-closes likely marketing emails (auto-close at ≥95% probability) to reduce analyst queue volume and alert fatigue. The post covers selected features and heuristics, guardrails to catch suspicious indicators so malicious emails aren’t auto-closed, business-aligned metrics (precision, percent benign, queue reduction), and a staged deployment approach (shadow then canary), emphasizing human-in-the-loop controls and monitoring for model degradation.