The subject matter of this specification can be embodied in, among other things, a computer-implemented method for securing email communications that includes receiving data including an email calculating a hash of the data, parsing the data into one or more atomic components, classifying the atomic component based on a collection of predetermined threat level categories, and providing an indication of a threat level category of the atomic component.