diff --git a/app/admin/sync/mimecast/page.tsx b/app/admin/sync/mimecast/page.tsx
index 1411c9e..5fb4c8d 100644
--- a/app/admin/sync/mimecast/page.tsx
+++ b/app/admin/sync/mimecast/page.tsx
@@ -1271,8 +1271,8 @@ function DeliveredMailTab() {
     );
 
   const statuses = [...new Set(messages.map(m => m.status).filter(Boolean))].sort();
-  const highRisk = messages.filter(m => (m.spamScore ?? 0) >= 10).length;
-  const medRisk = messages.filter(m => (m.spamScore ?? 0) >= 5 && (m.spamScore ?? 0) < 10).length;
+  const highRisk = messages.filter(m => (m.spamScore ?? 0) >= 10 || detectSubjectThreat(m.subject) !== null).length;
+  const medRisk = messages.filter(m => (m.spamScore ?? 0) >= 5 && (m.spamScore ?? 0) < 10 && detectSubjectThreat(m.subject) === null).length;
 
   return (
     <div className="space-y-4">
@@ -1414,7 +1414,13 @@ function DeliveredMailTab() {
               </thead>
               <tbody className="divide-y divide-border">
                 {filtered.map((m: any) => (
-                  <tr key={m.id} className={`hover:bg-muted/20 ${m.spamScore >= 10 ? 'bg-red-500/5' : m.spamScore >= 5 ? 'bg-amber-500/5' : ''}`}>
+                  <tr key={m.id} className={`hover:bg-muted/20 ${
+                    m.spamScore >= 10 || detectSubjectThreat(m.subject) !== null
+                      ? 'bg-red-500/5'
+                      : m.spamScore >= 5
+                        ? 'bg-amber-500/5'
+                        : ''
+                  }`}>
                     <td className="px-3 py-2 text-muted-foreground whitespace-nowrap text-xs">
                       {new Date(m.received).toLocaleString(undefined, { month: 'short', day: 'numeric', hour: '2-digit', minute: '2-digit' })}
                     </td>