The hidden back door in your work calendar

⚡ The Signal

While cybersecurity teams have spent decades hardening enterprise email gateways, attackers have quietly migrated to an unsanctioned front door: the calendar invite. Security researchers are observing an astounding 33,000% spike in calendar-based phishing attacks.

Because modern productivity platforms like Google Workspace and Microsoft 365 default to displaying or accepting incoming meeting requests, bad actors can insert malicious links, fraudulent phone numbers, and credential-harvesting prompts directly into an employee's daily schedule—bypassing traditional email security filters entirely.

🚧 The Problem

Enterprise email gateways inspect incoming messages for bad domains, suspicious attachments, and spoofed headers. But meeting invites operate under a different API model. When an external user sends an invite, the scheduling infrastructure parses the payload directly into the recipient's calendar store.

This creates two major vulnerabilities:

1. Implicit Trust: Employees view their schedule as a protected space, making them significantly more likely to click join links or dial callback numbers embedded in meeting descriptions.
2. Notification Hijacking: Desktop and mobile productivity apps push native alerts for upcoming events, effectively turning enterprise calendar software into a broadcast channel for attacker payloads.

As attackers scale automated tools, unsolicited calendar invites are becoming a primary entry point for corporate credential theft and social engineering.

🚀 The Solution

Enter Briar, an automated, real-time calendar security engine built specifically for Google Workspace and Microsoft 365.

Briar sits between external invitation webhooks and enterprise calendar stores. The platform inspects incoming meeting payloads, evaluates sender history, cross-references domain age and WHOIS records, and scans embedded URLs and phone numbers against live threat intelligence databases. If an invite contains lookalike domain links or suspicious callback routing, Briar instantly quarantines the event, strips harmful links, and alerts IT administrators before the invite ever appears on an employee's screen.

🎧 Audio Edition

Listen to Ada and Charles discuss today's business idea.

If you're reading this in your email, you may need to open the post in a browser to see the audio player.

💰 The Business Case

Revenue Model

Briar scales through a three-tiered B2B pricing model:

• Per-Seat SaaS Core ($1.50 – $3.00/user/month): Tiered subscription pricing based on connected seats across Google Workspace and Microsoft 365 tenants.
• Enterprise Security Tier: Custom pricing tier featuring dedicated SIEM integrations (Splunk, Microsoft Sentinel, Datadog), custom log retention policies, SOC 2 reporting, and enterprise SLAs.
• MSP / MSSP Partner Tier: A multi-tenant management portal allowing Managed Service Providers to bundle calendar security into their stack on a margin-share basis.

Go-To-Market

Briar drives top-of-funnel acquisition through low-friction security utilities:

• 1-Click Security Audit Tool: A read-only OAuth scanner that allows IT admins to run a free 60-second assessment of historical calendar threats across their tenant, instantly highlighting unverified external invites.
• Open-Source Graph & Apps Script Utility: A lightweight open-source scanner hosted on GitHub that highlights malicious invites, routing security leads to Briar's automated platform.
• Programmatic Knowledge Hub: Targeted technical documentation addressing high-intent queries around calendar phishing mitigation, API security policies, and domain reputation analysis.

⚔️ The Moat

While incumbents like Abnormal Security, Sublime Security, and Material Security focus primarily on the email inbox, Briar constructs an Organizational Relationship & Calendar Context Graph.

By mapping historical meeting interactions, recurring external domain communications, and internal attendance patterns across connected enterprise tenants, Briar establishes a deep baseline of legitimate organizational context. When a new threat pattern is detected within one organization, protective signatures immediately propagate across Briar's entire tenant network, creating compounding network effects and deep enterprise lock-in.

⏳ Why Now

The shift toward hybrid work and self-serve scheduling tools has made external calendar invites ubiquitous. Security teams left calendar APIs unmonitored while focusing heavily on inbox defense, opening a massive tactical blind spot.

With recent industry reports detailing a 33,000% surge in calendar phishing exploits and threat actors actively exploiting calendar invites as a preferred attack vector, reactive inbox security is no longer sufficient. Enterprise IT leaders need specialized API defense built specifically for calendar workflows.

🛠️ Builder's Corner

Building a real-time calendar defense engine requires low-latency event processing and rapid payload parsing. A solid architectural foundation uses a Python backend built with FastAPI to receive incoming webhook events from Microsoft Graph API delta tokens and Google Calendar Watch API endpoints.

As meeting payloads arrive, asynchronous workers perform real-time domain evaluation—combining WHOIS record queries, Levenshtein distance algorithms to detect lookalike domain spoofing, and API threat checks through services like VirusTotal and urlscan.io. Relational event mappings and organizational context graphs reside in PostgreSQL hosted on Supabase, while an administrative dashboard built with Next.js, Tailwind CSS, and Clerk handles enterprise SSO and policy configuration. Seat subscriptions and billing cycles can be managed cleanly through Stripe.

Legal Disclaimer: GammaVibe is provided for inspiration only. The ideas and names suggested have not been vetted for viability, legality, or intellectual property infringement (including patents and trademarks). This is not financial or legal advice. Always perform your own due diligence and clearance searches before executing on any concept.