Blog

6/13 Webinar: Handling Threats That Land in User Inboxes
Blog

6/13 Webinar: Handling Threats That Land in User Inboxes

Tue, 06/04/2019
The risk of a user receiving a phishing attack is higher than ever, and technological solutions often miss the most devastating of them. Though technology is both an important and required component in protecting the enterprise, security teams need to remain vigilant and educated on quickly identifying threats which make it past technology. This includes the latest social engineering...
Blog

These Are the Top Most Targeted Countries by Phishing Attacks

By Jessica Ryan on Thu, 05/23/2019
The United States is once again, and for the foreseeable future, the most targeted country by threat actors' phishing attacks. Making up an astonishing 84% of all phishing volume, the U.S. saw a single percent decline from 85% last year. But... While this sounds like a positive, the number of attacks went up by more than 60,000 in 2018. By comparison, the number of attacks in 2017 only went up...
The Most Common Types of Reported Emails
Blog

The Most Common Types of Reported Emails

Thu, 04/25/2019
There are all sorts of things that end up in your inbox, but among those that are reported to a SOC or security team, malicious content only makes up a small percent. Among the analysis provided in this year's annual Phishing Trends and Intelligence (PTI) report, we added a new section based on data from our Phishing Incident Response team. The data analysis resulted in a detailed breakdown of...
Hiding in Plain Sight: How Phishing Attacks are Evolving
Blog

Hiding in Plain Sight: How Phishing Attacks are Evolving

Thu, 02/07/2019
Phishing attacks are supposed to be visible. If you can't see them, how could anyone possibly fall for them? Since the dawning of time for phishing attacks there has been a constant struggle between the threat actors creating phishing sites and the individuals and organizations combating them. This has caused phishing attacks to evolve in to more complicated and stealthy traps over time....
How to Cut Healthcare Cyber Incidents by 80 Percent
Blog

How to Cut Healthcare Cyber Incidents by 80 Percent

Thu, 01/31/2019
Healthcare data breaches are among the most costly of any industry, and phishing attacks are the number one cause. Security technologies, while essential, are not enough to mitigate the threat posed by phishing. Over 90 percent of data breaches contain a phishing component, and the average cost to remediate a data breach is $3.86 million. However, the silver lining is that with an effective...
Less Than 3 Percent of ‘Collection #1' Data Dump Passwords are Unique
Blog

Less Than 3 Percent of ‘Collection #1' Data Dump Passwords are Unique

Wed, 01/23/2019
This month the largest recorded data dump in history, 87GB filled with passwords and user credentials, was made available. Dubbed Collection #1 consists of 1,160,253,228 unique combinations of email addresses and passwords. Though historic, there are two positive notes regarding this information: The first is that this data set was circulated on hacking forums back in December of 2018 and is...
Users Failing Phishing Simulations? That's ok
Blog

Users Failing Phishing Simulations? That's ok

Thu, 11/29/2018
Phishing simulations come with a range of emotions for the users who interact with them. Some will simply ignore them, others may fail by clicking on a link or attachment, and for the well-trained, they may even report them. Even if there is a negative outcome, training leads and organizations should not be worried, yet. Just like in school, these simulations are just that, simulations or...
The Light in the Dark: Myths and Truths about the Dark Web
Blog

The Light in the Dark: Myths and Truths about the Dark Web

Tue, 09/11/2018
There are many misconceptions about the dark web and what goes on in the digital underground. Though the dark web is usually associated with criminal activities including drug dealing, human trafficking, selling counterfeit consumer goods and many other malicious acts, not everything in the dark web is completely dark. Many questions are frequently asked about the dark web and to further...
Phishing 101: Targeted Phishing Attacks
Blog

Phishing 101: Targeted Phishing Attacks

Wed, 09/05/2018
The most likely way that you will be compromised online is through a simple phish or a socially engineered attack. Today, these two techniques are often combined to create an even more threatening attack, an intelligently targeted phish. Thanks to the wealth of information that we all leave behind us as we use the Internet, it is easier than ever for a social engineer to learn our name,...
How To Change Security Behaviors: Information Security
Blog

How To Change Security Behaviors: Information Security

Thu, 06/28/2018
Let's be honest, employees make mistakes. And sometimes those mistakes have catastrophic consequences. Everybody has heard stories about people accidentally leaving an unencrypted work laptop on the train, or on the seat of their car. Heck, on a busy day we could even imagine ourselves doing it. But with industry regulators finally starting to find their teeth — and the GDPR is now in full...
6 Steps to Quickly Defang Reported Phishing Emails
Blog

6 Steps to Quickly Defang Reported Phishing Emails

Thu, 05/03/2018
So here it is… the first one you've received. Everything has been building up to this. You spent days preparing the business case, weeks designing the training program… and it's finally paid off. The first user-reported phishing email has hit your inbox. Now… what should you do with it? Time is of the Essence Reported phishing emails are good for a lot of reasons. For starters, they can...
Blog

How To Make Reporting a Phish So Easy Even Your Busiest Execs Will Do It

Tue, 02/13/2018
Frustrating, isn't it? You design a powerful anti-phishing program, secure funding from your executive board, provide world-class training. You do everything right… Oh, your users are probably spotting phishing emails. After all, they've engaged with the training, and seem to be taking it seriously. But no matter how many times you remind them, they just won't report those phishing emails. ...
The 11 Types of Reported Emails
Blog

The 11 Types of Reported Emails

Thu, 01/18/2018
You receive an email, you are unfamiliar with the sender's name or email address, and they are offering you a new service or deal on something. Is it malicious? Not necessarily. Perhaps you forgot about signing up for a newsletter a while back. Malicious Versus Benign According to Symantec, 55.5 percent of business emails are considered spam emails, with the average business account getting...
A Quarter of Phishing Attacks are Now Hosted on HTTPS Domains: Why?
Blog

A Quarter of Phishing Attacks are Now Hosted on HTTPS Domains: Why?

Tue, 12/05/2017
The push for more widespread adoption of HTTPS has been in full-force this year as a way to increase the number of websites that securely transmit information on the Internet. In January, both Chrome and Firefox browsers began alerting users whenever sensitive information, such as passwords or credit card information, was entered on a non-HTTPS web page. In October, Google took this a step...
Holiday Phishing Scams Target Job Seekers
Blog

Holiday Phishing Scams Target Job Seekers

Tue, 11/21/2017
'Tis the season for shopping, time spent with friends and family, and preparations to celebrate the holidays. As most of us plan for the coming season, cyber criminals are looking for opportunities to catch victims off guard and steal valuable personal information. People looking to supplement their gift-giving budget with a seasonal holiday job should take a close look at job listings before...
The Impact of Phishing, and Why it Should be Your #1 Priority
Blog

The Impact of Phishing, and Why it Should be Your #1 Priority

Wed, 10/04/2017
Nation states. Hacktivists. Cyber criminals. There are so many players in the modern threat landscape it can be hard to keep up. And the number of threats? Practically too many to count. By the time you’ve secured your organization against password reuse, DDoS, and crimeware attacks, your resources are likely so diminished there’s no point even thinking about what else could be out there. ...
The Mobile Phishing Threat You'll See Very Soon: URL Padding
Blog

The Mobile Phishing Threat You'll See Very Soon: URL Padding

Thu, 06/15/2017
The fact that hackers are increasingly targeting mobile devices isn’t exactly a secret. And really, it’s not surprising either. After all, most of us are practically glued to our smartphones throughout the day. An SMS arrived? Better read it straight away. New email? Let me at it. Somebody I don’t care about updated their Facebook status? Great, let’s see what they’re up to. The...
How to Use URL Pattern Analysis for Phishing Detection Mitigation
Blog

How to Use URL Pattern Analysis for Phishing Detection Mitigation

Fri, 05/05/2017
When you’re attempting to mitigate the risk of phishing, threat intelligence plays a vital role. After all, what better way to predict and intercept future phishing attacks than by analyzing past attacks for patterns and indicators? This post is the second in a series breaking down lessons learned from our recent consumer-focused phishing webinar. In the first post we covered the value of...
The Phishing Email that Fooled Thousands of Trained Users
Blog

The Phishing Email that Fooled Thousands of Trained Users

Thu, 03/09/2017
It’s a sobering moment. You work long and hard to prepare your users. You train them. You test them. And over time, you see amazing results. But then it happens. Just when you think your users are becoming rockstars at identifying phishing emails, threat actors throw a new tactic at you… and everybody falls for it. Of course, this isn’t a new story. Threat actors constantly update their...
Phishing with Wildcard DNS Attacks and Pharming
Blog

Phishing with Wildcard DNS Attacks and Pharming

By Jessica Ryan on Fri, 03/03/2017
The cyclical relationship between threat actors and security professionals begins with the creation of a new attack technique, followed by the discovery of that technique by the security community, and then a refashioning of the manner of attack or creation of another novel approach by threat actors. Phishers are always seeking better ways to entice victims into providing their personal and...