Abstract: The present invention relates to a method of providing an automated reaction to malicious polymorphic messages, comprising the steps of: a) applying a handling process on non-reported messages for detecting existing polymorphic messages that are maliciously similar to one or more messages that are classified as suspicious, thereby enabling to define the detected non-reported polymorphic messages as suspicious; and b) applying mitigating actions to neutralize said suspicious non-reported detected messages.