Endpoint agent extension of a machine learning cyber defense system for email

An apparatus, comprising:

• an endpoint agent extension of a cyber defense system for email that includes two or more modules that are configure to cooperate with one or more machine learning models, comprising:
• an integration module of the endpoint agent extension configured to integrate the endpoint agent extension with an email client application on an endpoint computing device to detect email cyber threats in emails in the email client application as well as regulate outbound emails;
• an action module of the endpoint agent extension configured to interact with the email client application to direct autonomous actions, by the action module rather than a human taking an action, against at least an outbound email including its attached files and/or linked files under analysis when a cyber threat module determines the outbound email including its attached files and/or linked files (a) to be a data exfiltration threat, (b) to be both malicious and anomalous behavior as compared to a user's modeled email behavior, or (c) a combination of these two determinations, where the autonomous actions, against at least the outbound email and the files, include two or more actions selected from a group consisting of i) logging a user off the email client application, ii) preventing the sending of the outbound email, iii) stripping the attached files and/or disabling the link to the files from the outbound email, and iv) sending a notification to cyber security personnel of an organization regarding the outbound email;
• and
• a secure communications module in the endpoint agent extension configured to securely communicate with one or more modules in a cyber security appliance of the cyber defense system located in a network connected to the endpoint computing device, an email module in the cyber security appliance is configured to reference the one or more machine learning models that are trained on the normal behavior of email activity and user activity associated with at least the email system, where the email module determines a threat risk parameter that factors in a likelihood that a chain of two or more unusual behaviors of the email activity and user activity under analysis fall outside of derived normal benign behavior;
• and thus, are likely malicious behavior, where the action module, the secure communications module, and the integration module are part of the two or more modules of the endpoint agent extension, where when portions of i) the endpoint agent extension and ii) any modules are implemented in software, then their instructions are stored in one or more non-transitory machine readable storage mediums in a format when executed by the endpoint computing device to cause said endpoint computing device to perform operations listed for the apparatus.