In turn, CISOs have mobilized their users as an additional layer of detection, enabling individuals to report emails they find suspicious. While users often correctly identify phishing emails, they also report many benign emails, which creates a high operational load of user reports for security teams.
High effort, slow triage, ineffective user training.
CISOs face several challenges in operationalizing user reports to more effectively stop phishing attempts:
High effort to triage and analyze.
Security teams need to deal with a high monthly volume of user reports. Each reported email typically takes 15-60 minutes to resolve, with a very high false positive rate.
Slow to investigate and respond.
User reports are typically handled on a best-effort basis, with the time to triage and resolve measured in hours or days, rather than minutes.
Ineffective user training.
When organizations invest in training users to report suspicious emails, it results in a massive increase of reports. Because of the high volume, security teams struggle to effectively use these additional reports to detect and block phishing attempts.
Comprehensively shield your organization against phishing by extending detection and response to user-reported phishing attempts.
Ontinue ION for Enhanced Phishing Protection (ION for EPP) is an add-on service to Ontinue ION MXDR that extends the 24/7 triage, enrichment, investigation and response to phishing attacks, delivered in ION MXDR, to user-reported phishing emails. This enables you to better protect your organization against phishing attempts, without additional effort, all while maximizing your Microsoft Security investments.
Key capabilities of Ontinue ION for Enhanced Phishing Protection include:
Robust phishing prevention.
Ontinue ION for EPP leverages Defender for Office 365 email security controls, including best practice configurations to safely handle unknown links and attachments, to block phishing attempts well before they reach user inboxes.
Effective triage, enrichment, and investigation of user-reported emails.
Ontinue ION for EPP uses multiple layers of automation to weed out false positives, while enriching and investigating actual phishing emails within minutes. For more complex incidents, our security experts in the 24/7 Ontinue Cyber Defense Center (CDC) take over and run the incident to ground.
Faster, tailored response to phishing emails.
Ontinue ION for EPP executes email-specific responses at machine-speed when pre-authorized in the ION MXDR Rules of Engagement. When customer approval is needed, ION for EPP uses the ION MXDR Escalation Matrix to request response approval from the preferred escalation contact using the preferred contact method
