A gray banner indicates that YCG Email Protection did not find anything unusual or suspicious about the message. Even though the message was not classified as threatening, you should always check the displayed sender address and the source type to be sure it makes sense (e.g., an external webmail address for a message from a colleague may be cause for concern).
A yellow banner indicates that Email Protection found something unusual about the email message. It is not necessarily phishing or dangerous, but something you should be aware of. For example, a request for sensitive personal information should be given extra scrutiny. Mail that seems out of the ordinary or is spammy in some way may receive a yellow banner.
A red banner indicates that Email Protection thinks the message is suspicious and likely to be phishing or dangerous in some other way. This includes brand impersonations (e.g., a fake “account alert” email from your IT department), blacklisted phishing URLs, or attempts to spoof mail to look like it came from an internal company account.