Cybersecurity & Secure Access
Email & Web Security
Filtering on the two channels users are actually attacked through, with attachment and link analysis rather than reputation scoring alone.
The overwhelming majority of intrusions begin with an email or a web page, because both are channels an organisation deliberately leaves open to strangers. Filtering them is therefore the highest-yield preventive control available, and it is also the one where the difference between products is largest.
Reputation-based filtering catches bulk campaigns and misses targeted ones, because a domain registered that morning has no reputation either way. What catches those is analysis — opening the attachment in a sandbox, following the link to see where it actually lands, and checking whether the sender's domain is authorised to send at all through SPF, DKIM and DMARC.
The last of those is worth singling out because it protects other people from you as well. A domain without a DMARC policy can be spoofed freely, so an invoice fraud attempt against your customers can be sent convincingly from your own address.
What this covers
Attachment sandboxing
Suspicious files opened and observed in isolation before delivery, which catches what signature matching does not.
Link rewriting and time-of-click checks
URLs evaluated when the user clicks rather than only when the mail arrived, since a benign page can be weaponised in between.
SPF, DKIM and DMARC
Sender authentication configured properly, so your domain cannot be spoofed and inbound spoofing is rejected.
Impersonation detection
Detection of lookalike domains and display-name spoofing, which is how most payment-redirection fraud is attempted.
Web filtering
Category and reputation filtering with TLS inspection where policy permits, applied to remote workers as well as those on site.
What we will ask you
These are the questions that decide the specification. Having the answers ready is what turns a first conversation into a real quotation.
- 01
Is DMARC actually enforcing?
A policy of none monitors and prevents nothing. Moving to quarantine or reject is the step that matters, and it needs the legitimate senders enumerated first.
- 02
Are remote users filtered?
Web filtering that only applies on the office network stops applying to most staff on most days.
- 03
What happens to a reported phish?
Reporting with no triage process trains users to stop reporting.