Cloudstar builds behavioral profiles based on internal communication flow, known relationships, and messaging tone. It flags deviations—like unusual senders, domains, or message structures—that may indicate an impersonation attempt.