A gray banner indicates that the email filter did not find anything unusual or suspicious about the message. Even if the message was not classified as threatening, you should always verify the displayed sender address and source type to ensure it is legitimate (e.g., an external webmail address from a colleague may be cause for concern).
A yellow banner indicates that there may be something unusual about the email message. It is not necessarily phishing or dangerous, but something you should be aware of. For example, a request for sensitive personal information should be given extra scrutiny. An email that appears out of the ordinary or is spam-like may display a yellow banner.
A red banner indicates that the message is suspicious and likely to be phishing or dangerous in some other way. This includes brand impersonations (e.g., a fake “account alert” email from your IT department), blocked phishing URLs, or attempts to spoof email to appear to come from an internal company account.
