The way in which we respond to email security risks needs to change.
It’s no longer a case of reinforcing the network perimeter. The risks are now far more complex and nuanced, driven by human behaviour. From every conversation we have, Security and IT leaders tell us that people:
- Get hacked by what are increasingly sophisticated and targeted attacks
- Make mistakes, like sending sensitive emails to the wrong person or attaching the wrong file; and
- Break the rules, sometimes maliciously for personal gain but often unintentionally, thinking that they are just doing their job more efficiently!
These are a combination of both inbound and outbound threats but what they have in common is that they are human-activated risks – there’s a person behind each of them.
And these types of incidents are getting expensive.
Take the recent example of the junior lawyer in the UK who, overworked and overtired, sent a key client’s medical records to the wrong person. The fact that she was working incredibly long hours and dealing with all sorts of pressures (both business and personal) ultimately didn’t matter. Huge sums were lost to legal and settlement fees, the client was extremely unhappy, and the employee was suspended for six months!
Augmenting Microsoft 365’s native security
One of the reasons why this is such a hot topic right now is because existing approaches are not solving the problem.
In the old world, organizations with on-premise Exchange incorporated a Secure Email Gateway (SEG) to plug gaps in their architecture where spam and viruses were slipping through – and that made complete sense.
However, the threats have evolved and, in the face of much smarter bad guys and nuanced human behaviour, SEGs have struggled to detect far more sophisticated threats such as account compromise or, like the junior lawyer, somebody emailing sensitive content to the wrong person.
On top of that, Microsoft 365 (M365) has made great strides with its native security features rendering many SEG features void and creating unnecessary additional costs and unwanted administration.
And that’s where we come in. Rather than adding that unnecessary complexity and cost for duplicate features, customers are increasingly taking an integrated cloud email security approach and looking to us to augment M365, topping up key areas and adding additional value.
Here’s how …
Advanced detection techniques
First of all, our customers are leveraging far more sophisticated technologies so that they can detect even the most complex inbound and outbound risks. For example, a combination of machine learning and linguistic analysis techniques is enabling organizations to detect the smartest email attacks such as a compromised supply chain account. Similarly, patented contextual machine learning models are being applied to every individual to establish a baseline of their ‘normal’ email behaviour, meaning the tech can help them spot when they’re about to make a mistake like emailing sensitive content to the wrong person.
Armed with these technologies, a number of our clients have found from real data within their analytics platforms that they’re actually stopping over 30% more risks than M365 alone!
People as a first line of defense
Secondly, our vision is to create cybersecurity advocates within every organization.
Traditional training programs, though critical to driving security awareness, can also prove time-consuming and costly, regularly being seen as an unwanted distraction by employees.
Therefore, we need to augment existing phishing simulation and training programs and engage with employees to inform, assist and prevent a potentially costly security incident. It’s no longer about doing everything at the network edge; it’s about interacting with people at the individual level, using the proactive technologies we now have to provide real-time, teachable moments that empower them to stop future incidents themselves and build a culture of cybersecurity resiliency.
Making administration easy
Finally, we’re moving away from the information overload, heavy lifting and burdensome administration of traditional email security solutions. Customers always tell us that they’re just too complex and end up taking too much time to trawl through. That’s why we’re minimizing the amount of configuration required, only using policies to supervise our machine learning algorithms, while there’s no triage or quarantine for resource-constrained Security teams to manage as it’s all automated.
On top of that, we’re focusing on only providing actionable intelligence that Administrators can use to quickly identify organizational risks, put mitigating steps in place and, where necessary, remediate threats.
It's not about throwing too much information in our customers’ faces; it’s a case of cutting through the noise, highlighting the risks that matter, and making critical decisions faster.
Intelligent Email Security that mitigates human-activated risks
All of our advanced technologies, empowering teachable moments and hassle-free administration feed into our intelligent email security platform, which customers use to:
- Defend against sophisticated and targeted email attacks such as supply chain compromise, spoofing and zero-days
- Prevent emails going to the wrong person or with the wrong sensitive content; and
- Protect emails with the appropriate level of security and encryption
Applying these capabilities together, Security leaders can rest easy knowing that employees will keep sensitive data safe while enjoying the countless productivity benefits of M365.