text:
Why Tessian?
To prevent threats, your security controls must understand human behaviour.
View Tessian's integrations, compatibility, certifications and partnerships.
Turn your email data into your biggest defense.
Your Ultimate Guide to Human Layer Security →
How to Overcome the Multi-Billion Dollar Threat.
Achieve Next-generation Compliance by Reducing Email Risk.
Threat Visibility
Amplify Your Email Security with Granular Threat Visibility & Analytics.
CEO's Guide to Data Protection and Compliance →
Human layer security platform
Tessian Defender
Prevent Spear Phishing
Tessian Enforcer
Prevent Data Exfiltration
Tessian Guardian
Prevent Accidental Data Loss
Tessian HLS Intelligence
Investigate and Remediate
Tessian HLS intelligence Datasheet →
Tessian Defender Datasheet →
See all Datasheets →
Building a Human Layer Security Culture at ARM →
Securing the Future of Hybrid Working Report →
Human Layer Security
Why We Click:
The Psychology Behind Phishing Scams and How to Avoid Being Hacked .
Securing the human layer
About Tessian
Tessian protects every business's mission by securing the human layer.
We're on a mission to empower people to do their best work, without security getting in their way. Come join us.
News and updates about the Tessian, the world's first Human Layer Security platform.
RE: Human Layer Security podcast
The show that flips the script on cybersecurity and addresses the human factor.
See All Open Roles →
Prevent Spear Phishing Tessian Defender
Prevent Accidental Data Loss Tessian Guardian
Prevent Data Exfiltration Tessian Enforcer
[TMAL][StrokeIcon]
Investigate and Remediate HLS Intelligence
Technology Our Technology
All Resources Access the Content Library.
Securing the Future of Hybrid Working
Download the Research & Reports
All Blog Posts Your knowledge hub.
Data Exfiltration
Focusing on security basics, with game-changing technology
Read the Case Study.
About Tessian Securing the Human Layer.
Tessian Careers Tessian is growing. Grow with us.
Tessian Culture
Human Layer Security Summit On-Demand: 5 Sessions to Watch Now
By Maddie Rosenthal
In March, Tessian hosted its first Human Layer Security Summit. In June, we hosted our second. And, earlier this month, we hosted our third. Combined, that's 20 separate sessions, with nearly two dozen industry leaders from the world's top institutions, who covered topics ranging from deepfakes and the 2020 US election to the challenges associated with remote-working and the effectiveness of people-centric security strategies. Now, you can access all of this content on-demand in one place. Introducing Human Layer Security On-Demand. While every session is packed with valuable information, we've rounded up the top five videos you should watch now. Safeguarding the 2020 Elections, Disarming Deep Fakes Watch now If you weren't concerned about deepfakes before, you will be after watching this interview. According to Nina Schick, Author of "Deep Fakes and the Infocalypse: What You Urgently Need to Know", "This is not an emerging threat. This threat is here. Now." And, while we tend to associate deepfakes with election security, this is a threat that affects business' too. After watching the full session, make sure you check out this article for tips to help you and your employees spot impersonations: Deepfakes: What are They and Why are They a Threat? Why People Fall for Social Engineering in a Crisis Watch now To err is human. This is something we all know fundamentally. But, do you know why people make mistakes? In this session, Ed Bishop, Tessian CTO and Co-founder Ed Bishop discussed The Psychology of Human Error with Jeff Hancock, Communications Professor at Stanford University and David Kennedy, Co-Founder and Chief Hacking Officer at TrustedSec. The bottom line: people make more mistakes that compromise security (like falling for phishing scams and sending misdirected emails) when they're stressed, distracted, anxious, or and tired. And, as you might expect, people have been even more stressed, distracted, anxious, and tired over the last several months giving the global pandemic, new working conditions, and social and political unrest. How to Thrive in our New Normal with Stephane Kasriel Watch now In this interview, Tessian CEO and Co-founder Tim Sadler interviewed Stephane Kasriel, former CEO of Upwork. Why? Because Upwork has maintained a hybrid remote-working structure across 500 cities for 20 years, which meant (and still means!) that he's in a better position than most to offer advice around adapting and overcoming challenges related to distributed workforces. Stephane offered incredible advice that both security and business leaders should heed now and going forward as employees continue adjusting to their new work set-ups. Don't have time to watch the interview? You can read seven of his tips on our blog. Interview with Glyn Wintle, Ethical Hacker and CTO of Tradecraft Watch now At Tessian's first Human Layer Security Summit, Glyn Wintle, an Ethical Hacker and the Co-Founder and Chief Technology Officer of Tradecraft explained how hackers combine psychology and technical know-how to create highly targeted and highly effective spear phishing attacks to dupe targets.
In his presentation, he shared several tips to help people like you and me spot the phish. Check out his tips here. Perspectives on Risk Profiles From Around the World Watch now At Tessian, we know that diverse perspectives lead to diverse solutions. That's why for this session, we brought together Elvis Chan, Supervisory Special Agent of the FBI and Bobby Ford, Global CISO of Unilever. Both shared their observations on the evolving cybersecurity risks and how to keep organizations protected. One of the key takeaways? The secure thing to do should be the easiest thing to do. If you're a security leader trying to figure out how to make security more frictionless, this is a must-watch. Don't forget: there are 15 more sessions you can watch on-demand. Check them out now. Or, if you're interested in learning more about Human Layer Security and Tessian's products, book a demo.
Compliance Customer Stories Data Exfiltration DLP Human Layer Security Spear Phishing
18 Actionable Insights From Tessian Human Layer Security Summit
In case you missed it, Tessian hosted its third (and final) Human Layer Security Summit of 2020 on September 9. This time, we welcomed over a dozen security and business leaders from the world's top institutions to our virtual stage, including: Jeff Hancock from Stanford University David Kennedy, Co-Founder and Chief Hacking Officer at TrustedSec Merritt Baer, Principal Security Architect at AWS Rachel Beard, Principal Security Technical Architect at Salesforce Tim Fitzgerald, CISO at Arm Sandeep Amar, CPO at MSCI Martyn Booth, CISO at Euromoney Kevin Storli, Global CTO and UK CISO at PwC Elvis M. Chan, Supervisory Special Agent at the FBI Nina Schick, Author of "Deep Fakes and the Infocalypse: What You Urgently Need to Know" Joseph Blankenship, VP Research, Security & Risk at Forrester Howard Shultz, Former CEO at Starbucks While you can watch the full event on YouTube below, we've identified 18 valuable insights that security, IT, compliance, and business leaders should apply to their strategies as they round out this year and look forward to the next.
Here's what we learned at Tessian's most recent Human Layer Security Summit. Not sure what Human Layer Security is? Check out this guide which covers everything you need to know about this new category of protection. 1. Cybersecurity is mission-critical Security incidents – whether it's a ransomware attack, brute force attack, or data leakage from an insider threat – have serious consequences. Not only can people lose their jobs, but businesses can lose customer trust, revenue, and momentum. While this may seem obvious to security leaders, it may not be so obvious to individual departments, teams, and stakeholders. But it's essential that this is communicated (and re-communicated). Why? Because a company that's breached cannot fulfill its mission. Keep reading for insights and advice around keeping your company secure, all directly from your peers in the security community. 2. Most breaches start with people People control our most sensitive systems and data. It makes sense, then, that most data breaches start with people. But, that doesn't mean employees are the weakest link. They're a business' strongest asset! So, it's all about empowering them to make better security decisions. That's why organizations have to adopt people-centric security solutions and strategies.
The good news is, security leaders don't face an uphill battle when it comes to helping employees understand their responsibility when it comes to cybersecurity… 3. Yes, employees are aware of their duty to protect data Whether it's because of compliance standards, cybersecurity headlines in mainstream media, or a larger focus on privacy and protection at work, Martyn Booth, CISO at Euromoney reminded us that most employees are actually well aware of the responsibility they bear when it comes to safeguarding data. This is great news for security leaders. It means the average employee will be more likely to abide by policies and procedures, will pay closer attention during awareness training, and will therefore contribute to a more positive security culture company-wide. Win-win. 4. But, employees are more vulnerable to phishing scams outside of their normal office environment While – yes – employees are more conscious of cybersecurity, the shift to remote working has also left them more vulnerable to attacks like phishing scams. "We have three "places": home, work, and where we have fun. When we combine two places into one, it's difficult psychologically. When we're at home sitting at our coffee table, we don't have the same cues that remind us to think about security that we do in the office. This is a huge disruption," Jeff Hancock, Professor at Stanford University explained. Unfortunately, hackers are taking advantage of these psychological vulnerabilities. And, as David Kennedy, Co-Founder and Chief Hacking Officer at TrustedSec pointed out, this isn't anything new. Cybercriminals have always been opportunistic in their attacks and therefore take advantage of chaos and emotional distress. To prevent successful opportunistic attacks, he recommends that you: Reassess what the new baseline is for attacks Educate employees on what threats look like today, given recent events Identify which brands, organizations, people, and departments may be impersonated (and targeted) in relation to the pandemic But, it's not just inbound email attacks we need to be worried about. 5. They're more likely to make other mistakes that compromise cybersecurity, too This change to our normal environment doesn't just affect our ability to spot phishing attacks. It also makes us more likely to make other mistakes that compromise cybersecurity. Across nearly every session, our guest speakers said they've seen more incidents involving human error and that security leaders should expect this trend to continue. That's why training, policies, and technology are all essential components of any security strategy. More on this below. 6. Security awareness training has to be ongoing and ever-evolving At our first Human Layer Security Summit back in March, Mark Logsdon, Head of Cyber Assurance and Oversight at Prudential, highlighted three key flaws in security awareness training: It's boring It's often irrelevant It's expensive What he said is still relevant six months on and it's a bigger problem than ever, especially now that the perimeter has disappeared, security teams are short-handed, and individual employees are working at home and on their own devices. So, what can security leaders do? Kevin Storli, Global CTO and UK CISO at PwC highlighted the importance of tailoring training to ensure it's always relevant. That means that instead of just reminding employees about compliance standards and the importance of a strong password, we should also be focusing on educating employees about remote access, endpoints, and BYOD policies. But one training session isn't enough to make security best practice really stick. These lessons have to be constantly reinforced through gamification, campaigns, and technology. Tim Fitzgerald, CISO at Arm highlighted how Tessian's in-the-moment warnings have helped his employees make the right decisions at the right time. "Warnings help create that trigger in their brain. It makes them pause and gives them that extra breath before taking the next potentially unsafe step. This is especially important when they're dealing with data or money. Tessian ensures they question what they're doing," he said.
7. You have to combine human policies with technical controls to ensure security It's clear that technology and training are both valuable. That means your best bet is to combine the two. In discussion with Ed Bishop, Tessian Co-Founder and CTO, Merritt Baer, Principal Security Architect at AWS and Rachel Beard, Principal Security Technical Architect at Salesforce, both highlighted how important it is for organizations to combine policies with technical controls. But security teams don't have to shoulder the burden alone. When using tools like Salesforce, for example, organizations can really lean on the vendor to understand how to use the platform securely. Whether it's 2FA, customized policies, or data encryption, many security features will be built-in. 8. But…Zero Trust security models aren't always the answer While – yes – it's up to security teams to ensure policies and controls are in place to safeguard data and systems, too many policies and controls could backfire. That means that "Zero Trust" security models aren't necessarily the best way to prevent breaches.
9. Security shouldn't distract people from their jobs Security teams implement policies and procedures, introduce new software, and make training mandatory for good reason. But, if security becomes a distraction for employees, they won't exercise best practice. The truth is, they just want to do the job they were hired to do! Top tip from the event: Whenever possible, make training and policies customized, succinct, and relevant to individual people or departments. 10. It also shouldn't prevent them from doing their jobs This insight goes back to the idea that "Zero Trust" security models may not be the best way forward. Why? Because, like Rachel, Merrit, Sandeep, and Martyn all pointed out: if access controls or policies prevent an employee from doing their job, they'll find a workaround or a shortcut. But, security should stop threats, not flow. That's why the most secure path should also be the path of least resistance. Security strategies should find a balance between the right controls and the right environment. This, of course, is a challenge, especially when it comes to rule-based solutions. "If-then" controls are blunt instruments. Solutions powered by machine learning, on the other hand, detect and prevent threats without getting in the way. You can learn more about the limitations of traditional data loss prevention solutions in our report The State of Data Loss Prevention 2020. 11. Showing downtrending risks helps demonstrate the ROI of security solutions Throughout the event, several speakers mentioned that preemptive controls are just as important as remediation. And it makes sense. Better to detect risky behavior before a security incident happens, especially given the time and resources required in the event of a data breach. But tracking risky behavior is also important. That way, security leaders can clearly demonstrate the ROI of security solutions. Martyn Booth, CISO at Euromoney, explained how he uses Tessian Human Layer Security Intelligence to monitor user behavior, influence safer behavior, and track risk over time. "We record how many alerts are sent out and how employees interact with those alerts. Do they follow the acceptable use policy or not? Then, through our escalation workflows that ingest Tessian data, we can escalate or reinforce. From that, we've seen incidents involving data exfiltration trend downwards over time. This shows a really clear risk reduction," he said. 12. Targeted attacks are becoming more difficult to spot and hackers are using more sophisticated techniques As we mentioned earlier, hackers take advantage of psychological vulnerabilities. But, social media has turbo-charged cybercrime, enabling cybercriminals to create more sophisticated attacks that can be directed at larger organizations. Yes, even those with strong cybersecurity. Our speakers mentioned several examples, including Garmin and Twitter. So, how do they do it? Research! LinkedIn, company websites, out-of-office messages, press releases, and news articles all provide valuable information that a hacker could use to craft a believable email. But, there are ways to limit open-source recon. See tips from David Kennedy, Co-Founder and Chief Hacking Officer at TrustedSec, below.
13. Deepfakes are a serious concern Speaking of social media, Elvis M Chan, Supervisory Special Agent at the FBI and Nina Schick, Author of "Deep Fakes and the Infocalypse: What You Urgently Need to Know", took a deep dive into deepfakes. And, according to Nina, "This is not an emerging threat. This threat is here. Now." While we tend to associate deepfakes with election security, it's important to note that this is a threat that affects businesses, too. In fact, Tim Fitzgerald, CISO at Arm, cited an incident in which his CEO was impersonated in a deepfake over Whatsapp. The ask? A request to move money. According to Tim, it was quite compelling. Unfortunately, deepfakes are surprisingly easy to make and generation is outpacing detection. But, clear policies and procedures around authenticating and approving requests can ensure these scams aren't successful. Not sure what a deepfake is? We cover everything you need to know in this article: Deepfakes: What Are They and Why Are They a Threat? 14. Supply chain attacks are, too In conversation with Henry Treveleyan Thomas, Head of Customer Success at Tessian, Kevin Storli, Global CTO and UK CISO at PwC discussed how organizations with large supply chains are especially vulnerable to advanced impersonation attacks like spear phishing. "It's one thing to ensure your own organization is secure. But, what about your supply chain? That's a big focus for us: ensuring our supply chain has adequate security controls," he said. Why is this so important? Because hackers know large organizations like PwC will have robust security strategies. So, they'll look for vulnerabilities elsewhere to gain a foothold. That's why strong cybersecurity can actually be a competitive differentiator and help businesses attract (and keep) more customers and clients. 15. People will generally make the right decisions if they're given the right information 88% of data breaches start with people. But, that doesn't mean people are careless or malicious. They're just not security experts. That's why it's so important security leaders provide their employees with the right information at the right time. Both Sandeep Amar, CPO at MSCI and Tim Fitzgerald, CISO at Arm talked about this in detail. It could be a guide on how to spot spear phishing attacks or – as we mentioned in point #6 – in-the-moment warnings that reinforce training. Check out their sessions for more insights. 16. Success comes down to people While we've talked a lot about human error and psychological vulnerabilities, one thing was made clear throughout the Human Layer Security Summit. A business's success is completely reliant on its people. And, we don't just mean in terms of security. Howard Shultz, Former CEO at Starbucks, offered some incredible advice around leadership which we can all heed, regardless of our role. In particular, he recommended: Creating company values that really guide your organization Ensuring every single person understands how their role is tied to the goals of the organization Leading with truth, transparency, and humility
17. But people are dealing with a lot of anxiety right now Whether you're a CEO or a CISO, you have to be empathetic towards your employees. And, the fact is, people are dealing with a lot of anxiety right now. Nearly every speaker mentioned this. We're not just talking about the global pandemic. We're talking about racial and social inequality. Political unrest. New working environments. Bigger workloads. Mass lay-offs. Joseph Blankenship, VP Research, Security & Risk at Forrester, summed it up perfectly, saying "We have an anxiety-ridden user base and an anxiety-ridden security base trying to work out how to secure these new environments. We call them users, but they're actually human beings and they're bringing all of that anxiety and stress to their work lives." That means we all have to be human first. And, with all of this in mind, it's clear that….. 18. The role of the CISO has changed Sure, CISOs are – as the name suggests – responsible for security. But, to maintain security company-wide, initiatives have to be perfectly aligned with business objectives, and every individual department, team, and person has to understand the role they play. Kevin Storli, Global CTO and UK CISO at PwC touched on this in his session. "To be successful in implementing security change, you have to bring the larger organization along on the journey. How do you get them to believe in the mission? How do you communicate the criticality? How do you win the hearts and minds of the people? CISOs no longer live in the back office and address just tech aspects. It's about being a leader and using security to drive value." That's a tall order and means that CISOs have to wear many hats. They need to be technology experts while also being laser-focused on the larger business. And, to build a strong security culture, they have to borrow tactics from HR and marketing. The bottom line: The role of the CISO is more essential now than ever. It makes sense. Security is mission-critical, remember? If you're looking for even more insights, make sure you watch the full event, which is available on-demand. You can also check out previous Human Layer Security Summits on YouTube.
Human Layer Security Spear Phishing
Why We Click: The Psychology Behind Phishing Scams and How to Avoid Being Hacked
We all know the feeling, that awful sinking in your stomach when you realize you've clicked a link that you shouldn't have. Maybe it was late at night, or you were in a hurry. Maybe you received an alarming email about a problem with your paycheck or your taxes. Whatever the reason, you reacted quickly and clicked a suspicious link or gave away personal information only to realize you made a dangerous mistake. You're not alone. In a recent survey conducted by my company Tessian, two-fifths (43%) of people admitted to making a mistake at work that had security repercussions, while nearly half (47%) of people working in the tech industry said they've clicked on a phishing email at work. In fact, most data breaches occur because of human error. Hackers are well aware of this and know exactly how to manipulate people into slipping up. That's why emails scams — also known as phishing — are so successful. Phishing has been a persistent problem during the COVID-19 pandemic. In April, Google alone saw more than 18 million daily email scams related to COVID-19 in a single week. Hackers are taking advantage of psychological factors like stress, social relationships and uncertainty that affect people's decision-making. Here's a look at some of the psychological factors that make people vulnerable and what to look out for in a scam.
Stress and Anxiety Take A Toll Hackers thrive during times of uncertainty and unrest, and 2020 has been a heyday for them. In the last few months they've posed as government officials, urging recipients to return stimulus checks or unemployment benefits that were "overpaid" and threatening jail time. They've also impersonated health officials, prompting the World Health Organization to issue an alert warning people not to fall for scams implying association with the organization. Other COVID scams have lured users by offering antibody tests, PPE and medical equipment. Where chaos leads, hackers follow. The stressful events of this year mean that cybersecurity is not top-of-mind for many of us. But foundational principles of human psychology also suggest that these same events can easily lead to poor or impulsive decisions online. More than half (52%) of those in our survey said that stress causes them to make more mistakes. The reason for this has to do with how stress impacts our brains, specifically our ability to weigh risk and reward. Studies have shown that anxiety can disrupt neurons in the brain's prefrontal cortex that help us make smart decisions, while stress can cause people to weigh the potential reward of a decision over possible risks, to the point where they even ignore negative information. When confronted with a potential scam, it's important to stop, take a breath, and weigh the potential risks and negative information like suspicious language or misspelled words. Urgency can also add stress to an otherwise normal situation — and hackers know to take advantage of this. Look out for emails, texts or phone calls that demand money or personal information within a very short window. Hacking Your Network Some of the most common phishing scams impersonate someone in your "known" network, but your "unknown" network can also be manipulated. Your known network consists of your friends, family and colleagues — people you know and trust. Hackers exploit these relationships, betting they can sway someone to click on a link if they think it's coming from someone they know. These impersonation scams can be quite effective because they introduce emotion to the decision-making progress. If a phone call or email claims your family member needs money for a lawyer or a medical procedure, fear or worry replace logic. Online scams promising money add greed into the equation, while phishing emails impersonating someone in authority or someone you admire, like a boss or colleague, cloud deductive reasoning with our desire to be liked. The difference between clicking a dangerous link or deleting the email can involve simply recognizing the emotions being triggered and taking a second look with logic in mind. Meanwhile, the rise of social media and the abundance of personal information online has allowed hackers to impersonate your "unknown" network as well — people you might know. Hackers can easily find out where you work or where you went to school and use that information to send an email posing as a college alumnus to seek money or personal information. An easy way to check a suspicious email is by looking beyond the display name to examine the full email address of the sender by clicking the name. Scammers will often change, delete or add on a letter to an email address.
The Impact of Distraction and New Surroundings The rise of remote work brought on by COVID-19 can also impact people's psychological states and make them vulnerable to scams. Remote work can bring an overwhelming combination of video call fatigue, an "always on" mentality and household responsibilities like childcare. In fact, 57% of those surveyed in our report said they feel more distracted when working from home. Why is this a problem from a cybersecurity standpoint? Distraction can impair our decision-making abilities. Forty-seven percent of employees cited distraction as the top reason for falling for a phishing scam. While many people tend to have their guard up in a physical office, we tend to relax at home and may let our guard down, even if we're working. With an estimated 70% of employees working from home part or full-time due to COVID-19, this creates an opportunity for hackers. It's also more difficult to verify a legitimate request from an impersonation when you're not in the same office as a colleague. One common scam impersonates an HR staff member to request personal information from employees at home. When in doubt, don't click any links, download attachments or provide sensitive data like passwords, financial information or a social security number until you can confirm a request with a colleague directly. Self-Care and Awareness These scams will always be out there, but that doesn't mean people should constantly worry and keep their guard up — that would be exhausting. A simple combination of awareness and self-care when online can make a big difference. Once you know the tactics a hacker might use and the psychological factors like stress, emotions and distraction to look out for, it will be easier to spot an email scam without the anxiety. It's also important to take breaks and prioritize self-care when you're feeling stressed or tired. Step away from the computer when you can and have a conversation with your manager about why the pressure to be "always-on" when working remotely can have a negative impact psychologically and create cybersecurity risks. By understanding why people fall for these scams, we can start to find ways to easily identify and avoid them. This article was originally published in Fast Company and was co-authored by Tim Sadler, CEO of Tessian and Jeff Hancock, Harry and Norman Chandler Professor of Communication at Stanford University
Human Layer Security Tessian Culture
Why Customer Centricity is So Important At Tessian
By Samantha Holt
We believe this whole-heartedly at Tessian. That's why we've made Customer Centricity one of our six company values, and why we're making it – along with being Human-First – our focus going into Q4. So, what does "Customer Centricity" actually mean? It means that our customer's success doesn't sit with one functional team. Instead, it's the entire company's responsibility. It's embedded into every role, across every team. It's a part of Tessian's company culture. Whether we're launching a feature, or pursuing a partnership, we always ask "How does this help our current and future customers?" Keep reading to find out why customer-centricity is more important now than ever, what we're doing internally to ensure we're being guided by this value every day, and what we learned from Nick Mehta, a guru of Customer Success and the CEO of Gainsight, during his live discussion with Tessian CEO and Co-Founder, Tim Sadler. Why are we focusing on customer-centricity now? It's been a tumultuous few months for businesses around the world which means that two of our values are especially relevant: Customer Centricity and Human First. They go hand-in-hand. Nick explained why.
Instead of just looking at the effects of COVID-19 and the economic downturn from our perspective, we've stayed laser-focused on what our customers are going through. The ultimate question that we've asked ourselves – and will continue asking ourselves – is "How can we best support our customers through this period?" How can we help? How can we show real value? As we've said, we believe this is the responsibility of all Tessians. Nick does, too. "It's not just about the customer success function or customer-facing roles. It's all roles. Customer Success if about end-to-end customer experience, but everyone in the company touches that. In Finance, part of the customer experience is the invoice you send them and the collection emails you send. Those things matter a lot. If you're in Legal, the terms in your contract affect the customer experience. Are they friendly? Are they easy to understand? Even if you're not talking to a customer every day, you can still look at customer data to help you do your job better," he said. What are we doing internally to make sure we're being guided by these values? Here are steps we're taking this quarter to show our commitment to our customers: We're creating a more human experience for our customers. We've been thinking deeply about our customer journey during this period, in particular the AE-CSM holdover. We want our customer's experience to be as seamless – and as human – as possible. This influences how we communicate, when we communicate, and the ways in which we demonstrate value. It all comes back to being human-first and, as Nick said, "treating customers not just as a transaction or a deal, but as a group of human beings". We're empowering all Tessians to understand their role in customer success. During our Town Hall, we asked everyone at Tessian to take this quarter to reflect on this question: How does your role impact our customers? We're encouraging even those employees who aren't in customer-facing roles to explore the challenges our customers are facing and what we can do to best support them. We're also kicking off a Customer Success Book Club. Our first pick? Nick's latest book "The Customer Success Economy". This way, all Tessians can understand how to apply customer-centric principals to their specific role. We're immersed in customer feedback. We are taking the time to find even more ways to communicate with our customers during COVID, even without face-to-face meetings. We want to make sure we understand – at all times – how their priorities are shifting. That way, we can anticipate their needs and continue delivering an amazing customer experience. We're setting company-level OKRs focusing on Customer Centricity. While creating all of these initiatives and putting them into action are steps one and two, we have to somehow hold ourselves accountable. That's why we've set company-level OKRs. Now, individuals, teams, and entire departments across Tessian have goals set around Customer Centricity. These will be reviewed throughout the quarter to make sure we're always demonstrating this value and putting our customers first. The bottom line is: We're guided by our customers and we want to support them today and in the future, wherever and however they're working. What can other organizations do to make sure they're focusing on their customers? COVID has impacted all of us and while customers are certainly looking for value, they're also looking for a human touch. Empathy goes a long way. Here are some questions to reflect on: How can we break down silos in our company to ensure customers are at the forefront of every decision? In what areas of the business could we show more empathy to our customers, and err away from treating them as a transaction or deal? How can we reach out more frequently and regularly to our customers in a human-first way to ensure we are showing value?
Customer Stories DLP Human Layer Security
9 Questions That Will Help You Choose The Right Email Security Solution
When it comes to creating a cybersecurity strategy, security leaders have a lot to consider. There are various threat vectors, dozens of "types" of data to secure, thousands of products on the market, and oftentimes limited budget to work with. But, in this article, we're going to focus on email security. Why? Because 90% of data breaches start on email. Data could be compromised via a spear phishing attack. Malware contained in one malicious attachment could infect an entire organization's network. Insider threats could easily exfiltrate data for financial gain simply by emailing spreadsheets to their personal email accounts. That's why email is the threat vector security and IT leaders are most concerned about, and it's why choosing the right email security software is so critically important. Keep reading to learn: What nine questions you should ask when choosing an email security solution The solutions other security leaders across industries use to protect their people on email Why Tessian may be the right email security software for you How to get buy-in from your CEO after you've decided what the best solution is for your organization 1. Is it easy to deploy? Cybersecurity solutions should make life easier for your employees and your IT department. And, the bottom line is, a complicated setup process wastes time and resources. Worse still, it could lead to errors in deployment which may leave your company vulnerable. That's why email security software must be easy to deploy across your organization and it should seamlessly integrate with a variety of email clients, all without any administrative burden. Before getting too far into the sales process, make sure you find out what support the vendor will provide, how long deployment takes, and – whenever possible – talk to an existing customer to find out how their deployment was. 2. Is it scalable and customizable? As your company grows and changes, your business tools must adapt. This includes email security software, which should work for you consistently, regardless of your company's size. If you scale up or down, your email security software should change with you. Email security software must also allow customization so that it really aligns with your risk appetite, your employees' preferences, and your specific business context. Too little flexibility is stifling — but too much choice is overwhelming (and could be resource-intensive). 3. Does it prevent a wide range of threats? Today, cybersecurity solutions must detect and prevent a broader range of threats than ever before. And, when it comes to email security software, you have to consider both inbound and outbound threats, including: Spear phishing: A sophisticated phishing attack in which the attacker emails a specific, named target. Verizon's 2020 data breach report shows that 96% of social attacks (like spear phishing) occur via email. Check out more statistics related to social engineering attacks on our blog. Misdirected emails: An employee accidentally emails personal or sensitive data to the wrong recipient. This happens more often than you might think. The UK's privacy regulator cited misdirected emails as the number one cause of data breaches in quarter four of 2019-20 and, according to Tessian platform data, over 800 emails are sent to the wrong person every year in organizations with 1,000 people. Insider Threats: A trusted employee sends confidential or sensitive data to an unauthorized recipient. This recipient can be a third-party to whom a malicious insider is leaking intellectual property — or merely an employee forwarding correspondence to their personal email. Looking for more examples? We've rounded up 7 real-world Insider Threat examples here. 4. Can it keep up with the evolving threat landscape? Online threats are rapidly evolving and email security software is only as good as its ability to keep pace with these threats. Whether it's vishing, smishing, or a new type of malware, hackers are always looking for new ways to take advantage of security vulnerabilities and unsuspecting (and often untrained) employees. Can your email security software keep up? Tessian can. Scroll down to learn how Tessian uses machine learning to automatically "learn" and evolve in tandem with the threat landscape. 5. Are employees (and data) protected across devices? Businesses are increasingly reliant on cloud computing, remote working, and home offices — particularly since the outbreak of COVID-19. It's hard enough to protect a set of company workstations located on company premises. Trying to manage security on any number of desktop, laptop, and mobile devices — located in offices, public places, and your employees' homes — is even harder. But, unprotected devices represent a critical vulnerability in your company's security. That's why the right email security solution will work on any device that employees can use to access company data. 6. Is it easy to see (and communicate) ROI? It can be tough for security leaders to communicate the ROI of cybersecurity solutions. Why? Because it's hard to put a value on something that hasn't happened. But, a strong email security solution will make it easy for IT teams to assess risk, review trends over time, and create reports that demonstrate how risk is downtrending over time. This way, key stakeholders can really see the impact. Unfortunately, a lot of solutions today are a black box when it comes to investigating incidents and garnering insights. So, when choosing an email security solution, consider what reporting tools the solution offers and whether or not any manual investigation is required. Most security teams are already thinly stretched; communicating ROI shouldn't be an added burden. 7. Is it easy for employees to use? According to new research, 51% of employees say security tools and software impede their productivity. Likewise, 54% of employees say they'll find a workaround if security software or policies prevent them from doing their job. This proves that the most secure path also has to be the path of least resistance. If the security solution you're considering has high flag rates, creates extra work for your employees, or isn't user-friendly, it will go unused. This is a security risk. In layman's terms: security shouldn't get in the way. 8. Does it help ensure compliance? Increasingly strict data privacy laws are setting new standards for companies handling personal information. Businesses are accountable for taking a proactive approach to data security. You must take every reasonable step to ensure that the personal information in your control is kept safe and you must be able to demonstrate your security measures to regulators on demand. That means that, when evaluating potential email security solutions, you should not only understand what data loss incidents they prevent, but also which security certifications they've earned. 9. Has it been vetted by relevant customers and industry leaders? Before selecting an email security software provider, you must ensure that it is well-established and has testimonials from previous customers, preferably in your company's sector. Cybersecurity is a vast industry, and too many players are inexperienced, disreputable, or downright untrustworthy. You cannot afford to take any risks in choosing an email security software provider: reputation is everything in this field. Is Tessian the right email security solution for you?
Tessian is easy to deploy Deploying Tessian couldn't be simpler. The software integrates with all email environments, including Office 365, Microsoft Exchange, and GSuite. And, plug-and-play intelligent filters make individual customization easy. Setup is also extremely fast. Within 24 hours, Tessian analyzes an entire year's worth of your organization's historic email data. Immediately afterward, you're protected. No rules are required. Tessian is scalable and customizable Tessian's stateful machine learning technology is always evolving, designed to suit your business's needs as it scales and changes over time. Tessian automatically (and continuously) analyzes each employee's historic email behavior to learn what is and isn't "normal" for them. That way, it knows which emails to flag as anomalous. But, we also understand how important customization is. With Tessian Constructor, you can create and implement security rules specific to your organization. Tessian prevents a wide range of threats Across three solutions, Tessian's Human Layer Security platform can detect and prevent inbound and outbound threats, including advanced impersonation attacks, Insider Threats, and accidental data loss via misdirected emails. Tessian keeps pace with the evolving threat landscape Tessian doesn't rely on a list of signatures of known malware and scams. Our machine learning algorithms are actively learning all the time, which enables Tessian Defender, Guardian, and Enforcer to spot unusual activity and discover new threats. And, with Human Layer Security Intelligence, Tessian customers benefit from a sort of "herd immunity". If a threat is detected in another environment – for example, a never-before-seen social engineering attack – Tessian's entire community of users will automatically be protected. How? The suspicious domain will automatically be placed on a "denylist" and blocked. Tessian protects employees and data across devices Tessian is an ideal solution for remote or hybrid work environments. It protects your employees and your company's data on laptops, desktops, and mobile devices. Tessian makes it easy to see ROI Tessian Human Layer Security Intelligence provides security leaders with detailed, easy-to-understand and – best of all – automated threat reports. In a single click, you'll be able to see how your risk profile has improved over a certain period of time.
Security and IT teams can also get detailed information about specific incidents. Zero manual investigation required. Want to learn more about how Tessian customers can use HLSI to improve their security posture and communicate ROI? Read this: Introducing Tessian Human Layer Security Intelligence. Tessian is easy for employees to use Tessian is incredibly easy for anyone in your company to use. In fact, Tessian barely requires any "use" at all. The software runs silently in the background without any impediment to your employees' productivity whatsoever. Flag rates are low, warnings – when triggered – are helpful, not annoying, and our customers see a very low number of false positives. With Tessian, the most secure path is the path of least resistance. It's one piece of security software your employees will thank you for adopting.
Tessian helps ensure compliance The key to compliance with privacy law is assessing risks to privacy and taking reasonable steps to mitigate these risks. Email represents a critical risk area in any company's data security architecture. Tessian can assist with compliance in a way that other email security software cannot. Tessian Guardian is unique in its ability to prevent misdirected emails, which are the leading cause of data breach, according to reports by the ICO and the California Attorney-General. Given that misdirected email is such a common cause of data breaches, you must take steps to safeguard against this risk. But, it's also important to note that Tessian was designed with security and privacy in mind. You can learn more about our security certifications and how we ensure data privacy and protection here. Tessian has been vetted by industry leaders Leading organizations across industries rely on Tessian to protect their people and data on email. Here are just some of the many businesses that endorse Tessian, by sector: Legal Customers Hill Dickinson (case study) Dentons (case study) Caplin and Drysdale (case study) Financial Services Customers Webb Henderson (case study) Man Group (case study) Evercore (case study) Tech Customers Rightmove (case study) Gubra (case study) Com Lauda (case study) Insurance Customers North (case study) Healthcare Customers Laya Healthcare (case study) Tessian has also received recognition and plaudits from industry bodies and tech experts. In May 2020, Tessian was recognized as a Cool Vendor in the Gartner Cool Vendors in Cloud Office Security report, which recognizes security solutions that "focus specifically upon securing applications, communication and data that occur within cloud office environments." Tessian has also been independently tested by IT analyst firm 451 Research, which assessed how the software fared against its competitors in data-loss prevention. According to 451 Research's report, Tessian's machine learning algorithms allow it to succeed in preventing data loss where rule-based solutions fall short.
And, most recently, Tessian was included in Forrester's Now Tech: Report for Enterprise Email Security Providers. You can read more about why Tessian was selected here. While there is no one-size-fits-all approach to email security, this guide should help you research and vet which solution is right for you. If you're considering Tessian, why not book a demo to have these questions (and more) answered by one of our experts.
Not ready to book a demo yet? Learn more about your products, our customers, and our Human Layer Security vision via the links below: Why Tessian? Our Technology What is Human Layer Security? Customer Stories Bonus: If you have decided which email security solution is right for you but you're struggling to get buy-in from your CEO, read this guide with tips from the world's most innovative and trusted organizations.
Is Your Office 365 Email Secure?
By Subha Rama
In July this year, Microsoft took down a massive fraud campaign that used knock-off domains and malicious applications to scam its customers in 62 countries around the world. But this wasn't the first time a successful phishing attack was carried out against Office 365 (O365) customers. In December 2019, the same hackers gained unauthorized access to hundreds of Microsoft customers' business email accounts. According to Microsoft, this scheme "enabled unauthorized access without explicitly requiring the victims to directly give up their login credentials at a fake website…as they would in a more traditional phishing campaign." Why are O365 accounts so vulnerable to attacks? Exchange Online/Outlook – the cloud email application for O365 users – has always been a breeding ground for phishing, malware, and very targeted data breaches. Though Microsoft has been ramping up its O365 email security features with Advanced Threat Protection (ATP) as an additional layer to Exchange Online Protection (EOP), both tools have failed to meet expectations because of their inability to stop newer and more innovative social engineering attacks, business email compromise (BEC), and impersonations. One of the biggest challenges with ATP in particular is its time-of-click approach, which requires the user to click on URLs within emails to activate analysis and remediation. Is O365 ATP enough to protect my email? We believe that O365's native security controls do protect users against bulk phishing scams, spam, malware, and domain spoofing. And these tools are great when it comes to stopping broad-based, high-volume, low-effort attacks – they offer a baseline protection. For example, you don't need to add signature-based malware protection if you have EOP/ATP for your email, as these are proven to be quite efficient against such attacks. These tools employ the same approach used by network firewalls and email gateways – they rely on a repository of millions of signatures to identify 'known' malware. But, this is a big problem because the threat landscape has changed in the last several years. Email attacks have mutated to become more sophisticated and targeted and hackers exploit user behavior to launch surgical and highly damaging campaigns on people and organizations. Attackers use automation to make small, random modifications to existing malware signatures and use transformation techniques to bypass these native O365 security tools. Unsuspecting – and often untrained – users fall prey to socially engineered attacks that mimic O365 protocols, domains, notifications, and more. See below for a convincing example.
It is because such loopholes exist in O365 email security that Microsoft continues to be one of the most breached brands in the world. What are the consequences of a compromised account? There is a lot at stake if an account is compromised. With ~180 million O365 active email accounts, organizations could find themselves at risk of data loss or a breach, which means revenue loss, damaged reputation, customer churn, disrupted productivity, regulatory fines, and penalties for non-compliance. This means they need to quickly move beyond relying on largely rule- and reputation-based O365 email filters to more dynamic ways of detecting and mitigating email-originated risks. Enter machine learning and behavioral analysis. There has been a surge in the availability of platforms that use machine learning algorithms. Why? Because these platforms detect and mitigate threats in ways other solutions can't and help enterprises improve their overall security posture. Instead of relying on static rules to predict human behavior, solutions powered by machine learning actually adapt and evolve in tandem with relationships and circumstances. Machine learning algorithms "study" the email behavior of users, learn from it, and – finally – draw conclusions from it. But, not all of ML platforms are created equal. There are varying levels of complexity (going beyond IP addresses and metadata to natural language processing); algorithms learn to detect behavior anomalies at different speeds (static vs. in real-time); and they can achieve different scales (the number of data points they can simultaneously study and analyze). How does Tessian prevent threats that O365 security controls miss? Tessian's Human Layer Security platform is designed to offset the rule-based and sandbox approaches of O365 ATP to detect and stop newer and previously unknown attacks from external sources, domain / brand / service impersonations, and data exfiltration by internal actors. Learn more about why rule-based approaches to spear phishing attacks fail. By dynamically analyzing current and historical data, communication styles, language patterns, and employee project relationships both within and outside the organization, Tessian generates contextual employee relationship graphs to establish a baseline normal behavior. By doing this, Tessian turns both your employees and the email data into an organization's biggest defenses against inbound and outbound email threats. Conventional tools focus on just securing the machine layer – the network, applications, and devices. By uniquely focusing on the human layer, Tessian can make clear distinctions between legitimate and malicious email interactions and warn users in real-time to reinforce training and policies to promote safer behavior. How can O365 ATP and Tessian work together? Often, customers ask us which approach is better: the conventional, rule-based approach of the O365 native tools, or Tessian's powered by machine learning? The answer is, each has their unique place in building a comprehensive email security strategy for O365. But, no organization that deals with sensitive, critical, and personal data can afford to overlook the benefits of an approach based on machine learning and behavioral analysis. A layered approach that leverages the tools offered by O365 for high-volume attacks, reinforced with next-gen tools for detecting the unknown and evasive ones, would be your best bet. A very short implementation time coupled with the algorithm's ability to 'learn' from historical email data over the last year – all within 24 hours of deployment – means Tessian could give O365 users just the edge they need to combat modern day email threats.
Prove the Value of Cybersecurity Solutions: 16 Tips From Security Leaders
As a security or IT leader, researching and vetting security solutions is step one. What's step two, then? Convincing key stakeholders like the CEO, CFO, and the board that the product needs to be implemented, that it needs to be implemented now, and that it's worth the cost. This is easier said than done, especially now that organizations around the world are facing budget cuts in the wake of COVID-19. But, security is business-critical. So, how do you communicate risk and make a compelling case to (eventually) get buy-in from executives? We talked to security leaders from some of the world's most trusted and innovative organizations to find out what they do to get buy-in from CxOs. Here's a summary of their tips. You can download this infographic with a quick summary of all of the below tips. This is perfect for sharing with peers or colleagues. Or, download this eBook. 1. Familiarize yourself with overall business objectives While cybersecurity has historically been a siloed department, today, it's an absolutely essential function that supports and enables the overall business. Think about the consequences of a data breach beyond lost data. Organizations experience higher rates of customer churn, reputations are damaged, and, with regulatory fines and the cost of investigation and remediation, there can be significant revenue loss. The key, then, is to attach cybersecurity initiatives to key business objectives. The security leaders we interviewed recommended starting by reviewing annual reports and strategic roadmaps. Then, build your business case. If customer retention and growth are KPIs for the year, insist that cybersecurity builds customer trust and is a competitive differentiator. If the organization is looking for higher profits, make it clear how much a breach would impact the company's bottom line. (According to IBM's latest Cost of a Data Breach, the average cost of a data breach is $3.86 million.) 2. Create specific "what-if" scenarios A lot of security solutions are bought reactively (after an incident occurs), but security leaders need to take a proactive approach. The problem is, it's more challenging for CxOs and the board to see the value of a solution when they haven't yet experienced any consequences without it. As the saying goes, "If it ain't broke, don't fix it". That's why security leaders have to preempt push-back to proactive pitches by outlining what the consequences would be if a solution isn't implemented so that stakeholders can understand both probability and impact. For example, if you're trying to get buy-in for an outbound email security solution, focus on the "what-ifs" associated with sending misdirected emails which – by the way- are sent 800 times a year in organizations with 1,000 employees. Ask executives to imagine a situation in which their biggest clients' most sensitive data lands in the wrong inbox. What would happen? Make sure you identify clear, probable consequences. That way, the situation seems possible (if not likely) instead of being an exaggerated "worst-case scenario". 3. Work closely with the security vendor You know your business. Security vendors know their product. If you combine each of your expertise – and really lean on each other – you'll have a much better chance of making a compelling case for a particular solution. Ask the vendor for specific resources (if they don't exist, ask them to create them!), ask for product training, ask if you can speak with an existing customer. Whatever you need to get buy-in, ask for it. Rest assured, they'll be happy to help. 4. Collaborate and align with other departments It takes a village and cybersecurity is a "people problem". That means you should reach out to colleagues in different departments for advice and other input. Talk to the folks from Risk and Compliance, Legal, HR, Operations, and Finance early on. Get their opinion on the product's value. Find out how it might be able to help them with their goals and initiatives. In doing so, you might even be able to pool money from other budgets. Win-win! 5. Consider how much the executive(s) really know about security To communicate effectively, you have to speak the same language. And, we don't just mean English versus French. We mean really getting on the same level as whomever you're in conversation with. But, to do that, you have to first know how much your audience actually knows about the topic you're discussing. For example, if you look into your CEO's background and find out that he or she studied computer science, you'll be able to get away with some technical jargon. But, if their background is limited to business studies, you'll want to keep it simple. Avoid security-specific acronyms and – whatever you do – don't bury the point underneath complex explanations of processes. In short: Don't succumb to the Curse of Knowledge.
6. Use analogies to put costs into perspective One of the best ways to avoid the Curse of Knowledge and give abstract ideas a bit more context is to use analogies. It could be the ROI of a product or the potential cost of a breach. Either way, analogies can make big, somewhat meaningless numbers more tangible and impactful. For example, imagine you're trying to convince your CFO that the cost of a solution is worth it. But, the 6-digit, one-time cost is a hard sell. What do you do? Break the overall cost down by the product's lifespan. Then, divide that number by the number of employees it will protect during that same period. Suddenly, the cost will seem more manageable and worth the investment. 7. Invite key stakeholders to events or webinars Before you even start pitching a particular solution, warm-up executives with educational webinars or events that aren't product-specific. This will give CxOs a chance to better understand the problem, how it might apply to them, and how other people/organizations are finding solutions. Bear in mind: most vendors will have at least 1 (generally 2+) webinars or events during the standard sales cycle. Looking for events to attend? We've put together this list of 20 cybersecurity and business events – including Tessian Human Layer Security Summit – perfect for inviting your non-technical colleagues to. 8. Prepare concise and personalized briefing materials Individual stakeholders will be more likely to consider a particular solution if the problem it solves is directly relevant to them. How? Combine tips #1, #2, #3, and #5. After taking some time to understand the business' overall objectives, take a closer look at individual peoples' roles and responsibilities in meeting those objectives. Then, dig a bit deeper into how much they know about cybersecurity. Imagine you're meeting with a COO with some technical experience whose focus is on maintaining relationships with customers. His or her briefing documents should contain minimal technical jargon and should focus on how a data breach affects customer churn. The bottom line: make it about them. 9. Share these documents in advance of any formal meetings While this may seem obvious, the security leaders we spoke to made it clear that this is an essential step in getting buy-in. No one wants to feel caught off guard, unprepared, or rushed. To avoid all of the above, make sure you share any documents relevant to the solution well in advance of any formal meetings. But, don't just dump the documents on their desk or in their inbox. Outline exactly what each document is, why it's relevant to the meeting, and what the key takeaways are. You want to do whatever you can to help them absorb the information, so make sure you make yourself available after sharing the documents and before the meeting, just in case they have any questions or need additional information. 10. Build a strong security culture Before we dive into why building a strong security culture can help you get buy-in, we want to make it clear that this isn't something that can happen overnight. This is a long-term goal that requires the help of the entire organization. Yes, everyone. So, how do you build a strong security culture? Start by ensuring that security and IT teams are committed to helping – not blaming – employees. There has to be a certain level of mutual trust and respect. Beyond that, employees have to accept responsibility for the overall security of the organization. They have to understand that their actions – whether it's clicking on a phishing email or using a weak password – have consequences. If they do accept this responsibility, and if they genuinely care about following policies and procedures and helping secure data and networks, high-level executives will care, too. They'll therefore be more likely to sign-off on solutions. 11. Keep an eye on security trends outside of your industry Some industries – specifically Healthcare, Financial Services, and Legal – are bound to compliance standards that formalize the need for effective security solutions. That means that, compared to other industries like Retail or Manufacturing, they'll be required to have more robust strategies in place. What they're doing now, the rest of us will be doing in 12 months. Keep this in mind. If you notice that organizations operating in the most highly regulated industries are all taking data loss prevention (DLP) seriously, you'll be able to make a strong case that this is something that should be on your radar, too. 12. Approach non-executive stakeholders early on While – yes – getting buy-in from CxOs and the board is important, security leaders also need to get buy-in from non-executive stakeholders working in IT, infrastructure, etc. After all, those are the people who will actually be responsible for deploying the solution and maintaining it.By approaching them early on (and assuming they're interested in the solution, too) you'll be able to paint a clear picture of the process after the solution has been signed off on. How long will it take? Who's involved? Will employees' workflow be disrupted? These are all important questions to answer. 13. Match like-for-like people from both sides If you're scheduling a meeting with executives from your side and key people from the vendor's side, make sure you're bringing in people that "match" in terms of function and seniority level. For example, if you work at a start-up and the founder of your company wants to be involved in the buying process, ask the vendor's founders to join, too. Likewise, if the Head of Infrastructure is joining from your side, ask someone in a similar function to join from the other side. Why? Like-for-like people will be best placed to answer one another's questions. And, with that in mind…. 14. Preempt questions and prepare answers No one likes to be put on the spot. To avoid being asked a question that you don't know the answer to, spend a good amount of time considering all the questions different stakeholders may ask and drafting well-thought-out answers. (Better yet, fit the answers into briefing documents or the presentation itself!) Remember, people are generally concerned with how a problem/solution affects them directly. That means the CEO will have different questions than the CFO, who will have different questions than the Head of IT. 15. Get specific customer references from the vendor We mentioned in tip #3 that you should lean on the vendor, especially when it comes to specific resources and customer references. And, we mentioned in tip #11 that you should match like-for-like people in meetings. It should make sense, then, that specific customer references will be more powerful than generic ones. For example, if you're the CISO at a 4,000-person tech firm in North America, and you're trying to convince you're CTO that you need to implement a new solution, you should share a case study (or customer reference) from the vendor that outlines how their product has helped an organization in the same industry, that's the same size, and in the same region. Ideally, it will also feature quotes from the CTO. Why? Professionals trust and rely on their peers when making difficult decisions. 16. Be conscious (and considerate of) peoples' time Decisions about security solutions can involve a lot of different people. That means you'll have to balance several conflicting schedules and fight for time. Your best bet? Book meetings with all relevant people at once and get the vendor involved at the same time. Ahead of the meeting, share an agenda along with any relevant documents (see tip #8). Are you a security leader who wants to offer advice to your peers? We'd love to hear from you! Please get in touch with [email protected] And, if you're looking for more advice, check out these blogs: How to Communicate Cybersecurity ROI Advice from Security Leaders for Security Leaders: How to Navigate New Remote-Working Challenges How to Create an Enduring and Flexible Cybersecurity Strategy
8 Reasons To Register Now For Tessian Human Layer Security Summit
If your calendar is filling up with virtual events, make sure you leave space for Tessian Human Layer Security Summit on September 9. What is it? A (virtual) event featuring industry leaders from the world's top organizations that was designed to help business, security, compliance, and IT professionals prepare for what's next…whatever that may be. Keep reading to find out what you'll learn, who the speakers are, and why you have to register now. 1. You'll get an FBI agent's perspective on election hacking With the US election coming up in November, people and media around the world are talking about election hacking. That's why we're bringing Elvis Chan from the FBI to the Human Layer Security Summit "stage". Elvis will review key events from the 2016 elections, highlight the tactics nation-state hackers are most likely to use this year, and offer advice on how to protect yourself and your organization from being hacked. 2. You'll hear from Howard Schultz and other industry leaders from AWS, Salesforce, and PwC about how they're leading their organizations through change If you're struggling to keep up with the pace of new cyber threats while also supporting stressed employees as they continue working remotely, you're not alone. So, why not lean on your peers and learn from their experiences? At this event, experts from AWS, Salesforce, PwC, TrustedSec, MSCI, Euromoney Institutional Investor, and more will be sharing their anecdotes and advice to help you create future-proof security strategies. You'll also hear from business titan and the former CEO of Starbucks, Howard Schultz. But, adapting to the 'new normal" isn't the only thing we'll be talking about…
3. A Stanford psychology professor will explain why people make mistakes that lead to breaches (and what you can do about it) Tessian's latest research report, The Psychology of Human Error, shows that nearly half (43%) of people have made mistakes at work that compromised cybersecurity. But, why do people make mistakes? Register now and you'll find out on September 9. Jeff Hancock, Professor at Stanford University will identify factors that make people – just like you and me – more likely to fall for phishing scams and fire off emails to the wrong people. Spoiler Alert: Burnout and distraction are two of the top contributors. 4. You can be a part of the conversation Just because the event is virtual doesn't mean you can't get involved… Throughout the three-hour-long event, you'll be able to submit questions to be answered live. Whether you want to ask Rachel Beard, the Principal Security Technical Architect at Salesforce how she's combatting hacker's increasingly sophisticated phishing tactics or want to probe David Kennedy about penetration testing post-pandemic, this is your opportunity. Don't miss out! 5. You'll walk away with truly actionable advice As we've said, Tessian Human Layer Security Summit was designed to help business and security leaders prepare for what's next. The key, then, is to make sure that all attendees walk away (er, log off) with advice they can actually put into action. You should expect to learn how to stop your employees from falling for social engineering attacks, ways in which you can tailor training for better results, why people-centric security strategies are more essential now than ever, and more. Click here for a full agenda. 6. You'll learn what the future holds, according to a Forrester security analyst Because of Forrester's insights, reports, and analysis, the firm is trusted by business and security leaders around the world and across industries. We're delighted, then, to be welcoming Joseph Blankenship, Forrester's VP, Research Director serving Security & Risk Professionals. He'll be offering his expert opinion on where the industry is heading next and best practices to help you implement strategies in emerging areas of security. Remember: You can ask questions! What do you want to ask Joseph? 7. It's the last HLS Summit of the year In March, Tessian hosted the world's first Human Layer Security Summit. In June, we hosted the world's second Human Layer Security Summit. In September, we're hosting the world's third Human Layer Security Summit and it's the last big HLS event of 2020. And, because we've taken feedback from over two thousand people who have attended previously, this will be the best one yet. Want to know what to expect? Check out these videos, featuring Stephane Kasriel, the former CEO of Upwork, Bobby Ford, Global CISO of Unilever, and more. 8. It's free! That's right. The event is completely free. All you have to do is sign-up. You'll be in good company! Register now to save your spot and we'll "see" you on September 9. Can't make it on September 9? Don't worry, by registering, you'll have on-demand access to watch the full series of keynotes, panel discussions, and more after the live session. Do you know anyone else who should attend? Whether it's your CEO or your sister, just send them this link.
Data Exfiltration DLP Human Layer Security Spear Phishing
Research Shows Employee Burnout Could Cause Your Next Data Breach
By Laura Brooks
Understanding how stress impacts your employees' cybersecurity behaviors could significantly reduce the chances of people's mistakes compromising your company's security, our latest research reveals. Consider this. A shocking 93% of US and UK employees told us they feel tired and stressed at some point during their working week, with one in 10 feeling tired every day. And perhaps more worryingly, nearly half (46%) said they have experienced burnout in their career. Then consider that nearly two-thirds of employees feel chained to their desks, as 61% of respondents in our report said there is a culture of presenteeism in their organization that makes them work longer hours than they need to. Nearly 70% of employees also agreed that there is an expectation within their company to respond to emails quickly. Employees are overwhelmed, overworked and are feeling the pressure to keep pace with their organization's demands.
The effects of the pandemic The events of 2020 haven't helped matters either. In the wake of the global pandemic, people have experienced extremely stressful situations that affected their health and finances, against a backdrop of political uncertainty and social unrest, while simultaneously juggling the demands of their jobs. The sudden shift to remote working also meant that people were surrounded by new distractions, and over half of respondents (57%) told us they felt more distracted when working from home. According to Jeff Hancock, a professor at Stanford University who collaborated with us on this report, people tend to make mistakes or decisions they later regret when they are stressed and distracted. This is because when our cognitive load is overwhelmed, and when our attention is split between multiple tasks, we aren't able to fully concentrate on the task in front of us. What does this mean for security? Not only are these findings incredibly concerning for employees' health and wellbeing, these factors could also explain why mistakes that compromise cybersecurity are happening more than ever. The majority of employees (52%) we surveyed said they make more mistakes at work when they are stressed. !function(e,i,n,s){var t="InfogramEmbeds",d=e.getElementsByTagName("script")[0];if(window[t]&&window[t].initialized)window[t].process&&window[t].process();else if(!e.getElementById(n)){var o=e.createElement("script");o.async=1,o.id=n,o.src="https://e.infogram.com/js/dist/embed-loader-min.js",d.parentNode.insertBefore(o,d)}}(document,0,"infogram-async"); Younger employees seem to be more affected by stress than their older co-workers, though. Nearly two-thirds of workers aged 18-30 years old (62%) said they make more mistakes when they are stressed, compared to 45% of workers over 51 years old. Our research also revealed that 43% and 41% of employees believe they are more error-prone when tired and distracted, respectively. In fact, people cited distraction as the top reason for why they fell for a phishing scam at work while 44% said they had accidentally sent an email to the wrong person (44%) because they were tired. While these mistakes may seem trivial on the surface, phishing is the number one threat vector used by hackers today and one in five companies told us they have lost customers as a result of an employee sending an email to the wrong person. Far from red-faced embarrassment, these mistakes are compromising businesses' cybersecurity.
The other problem is that hackers are preying on our vulnerable states, and using them to their advantage. Cybercriminals know people are stressed and looking for information about the pandemic and remote working. They know that some individuals are struggling financially and others have lost their jobs. The lure of a 'too-good-to-be-true' deal or 'get a new job fast' offer may suddenly look very appealing, especially if the email appears to have come from a trusted source, and cause people to click. So what can businesses do to protect employees from mistakes caused by burnout? Business and security leaders need to realise that it's unrealistic for employees to act as the company's first line of defence. You cannot expect every employee to spot every scam or make the right cybersecurity decision 100% of the time, particularly when they're dealing with stressful situations and working in environments filled with distractions. When faced with never-ending to-do lists and back-to-back Zoom calls, cybersecurity is the last thing on people's minds. In fact, a third of respondents told us they "rarely" or "never" think about security when at work. Businesses, therefore, need to create a culture that doesn't blame people for their mistakes and, instead, empowers them to do great work without security getting in the way. Understand how stress impacts people's cybersecurity behaviors and tailor security policies and training so that they truly resonate for every employee.
Educating people on how hackers might take advantage of their stress and explaining the types of scams that people could be susceptible to is an important first step. For example, a hacker could impersonate a senior IT director, supposedly communicating the implementation of new software to accommodate the move back into the office, and asks employees to share their account credentials. Or a hacker may pose as a trusted government agency requesting personal information in relation to a new financial relief scheme. Businesses should also implement solutions that can help employees make good cybersecurity decisions and reduce risk over time. Security solutions like Tessian use machine learning to understand employee behaviors to alert people to risks on email as and when they arise. By warning individuals in real-time, we can educate individuals as to why the email they were about to send or have received is a threat to company security. It helps to make people think twice before they do something they might regret. With remote working here to stay, and with hackers continually finding ways to capitalize on people's stress in order to manipulate them, businesses must prioritize cybersecurity at the human layer. Only by understanding why people make mistakes that compromise cybersecurity, can you begin to prevent burnout from causing your next data breach.
Compliance Data Exfiltration DLP Human Layer Security
You Sent an Email to the Wrong Person. Now What?
So, you've sent an email to the wrong person. Don't worry, you're not alone. According to Tessian research, over half (58%) of employees say they've sent an email to the wrong person. We call this a misdirected email and it's really, really easy to do. It could be a simple spelling mistake, it could be the fault of Autocomplete, or it could be an accidental "Reply All". But, what are the consequences of firing off an email to the wrong person and what can you do to prevent it from happening? We'll get to that shortly. But first, let's answer one of the internet's most popular (and pressing) questions: Can I stop or "un-send" an email?
Can I un-send an email? The short (and probably disappointing) answer is no. Once an email has been sent, it can't be "un-sent". But, with some email clients, you can recall unread messages that are sent to people within your organization. Below, we'll cover Outlook/Office 365 and Gmail. Recalling messages in Outlook & Office 365 Before reading any further, please note: these instructions will only work on the desktop client, not the web-based version. They also only apply if both you (the sender) and the recipient use a Microsoft Exchange account in the same organization or if you both use Microsoft 365. In layman's terms: You'll only be able to recall unread emails to people you work with, not customers or clients. But, here's how to do it. Step 1: Open your "Sent Items" folder Step 2: Double-click on the email you want to recall Step 3: Click the "Message" tab in the upper left-hand corner of the navigation bar (next to "File") → click "Move" → click "More Move Actions" → Click "Recall This Message" in the dropdown menu Step 4: A pop-up will appear, asking if you'd like to "Delete unread copies of the message" or "Delete unread copies and replace with a new message" Step 5: If you opt to draft a new message, a second window will open and you'll be able to edit your original message While this is easy enough to do, it's not foolproof. The recipient may still receive the message. They may also receive a notification that a message has been deleted from their inbox. That means that, even if they aren't able to view the botched message, they'll still know it was sent. More information about recalling emails in Outlook here. Recalling messages in Gmail Again, we have to caveat our step-by-step instructions with an important disclaimer: this option to recall messages in Gmail only works if you've enabled the "Delay" function prior to fat fingering an email. The "Delay" function gives you a maximum of 30 seconds to "change your mind" and claw back the email. Here's how to enable the "Delay" function. Step 1: Navigate to the "Settings" icon → click "See All Settings" Step 2: In the "General" tab, find "Undo Send" and choose between 5, 10, 20, and 30 seconds. Step 3: Now, whenever you send a message, you'll see "Undo" or "View Message" in the bottom left corner of your screen. You'll have 5, 10, 20, or 30 seconds to click "Undo" to prevent it from being sent. Note: If you haven't set-up the "Delay" function, you will not be able to "Undo" or "Recall" the message. More information about delaying and recalling emails in Gmail here. So, what happens if you can't recall the email? We've outlined the top six consequences of sending an email to the wrong person below.
What are the consequences of sending a misdirected email? We asked employees in the US and UK what they considered the biggest consequences of sending a misdirected email. Here's what they had to say. !function(e,t,s,i){var n="InfogramEmbeds",o=e.getElementsByTagName("script"),d=o[0],r=/^http:/.test(e.location)?"http:":"https:";if(/^\/{2}/.test(i)&&(i=r+i),window[n]&&window[n].initialized)window[n].process&&window[n].process();else if(!e.getElementById(s)){var a=e.createElement("script");a.async=1,a.id=s,a.src=i,d.parentNode.insertBefore(a,d)}}(document,0,"infogram-async","//e.infogram.com/js/dist/embed-loader-min.js"); Importantly, though, the consequences of sending a misdirected email depend on who the email was sent to and what information was contained within the email. For example, if you accidentally sent a snarky email about your boss to your boss, you'll have to suffer red-faced embarrassment (which 36% of employees were worried about). If, on the other hand, the email contained sensitive customer, client, or company information and was sent to someone outside of the relevant team or outside of the organization entirely, the incident would be considered a data loss incident or data breach. That means your organization could be in violation of data privacy and compliance standards and may be fined. But, incidents or breaches don't just impact an organization's bottom line. It could result in lost customer trust, a damaged reputation, and more. Let's take a closer look at each of these consequences. Fines under compliance standards. Both regional and industry-specific data protection laws outline fines and penalties for the failure to implement effective security controls that prevent data loss incidents. Yep, that includes sending misdirected emails. Under GDPR, for example, organizations could face fines of up to 4% of annual global turnover, or €20 million, whichever is greater. And these incidents are happening more often than you might think. Misdirected emails are the number one security incident reported to the Information Commissioner's Office (ICO). They're reported 20% more often than phishing attacks. You can read more about the biggest fines under GDPR so far in 2020 on our blog. Lost customer trust and increased churn. Today, data privacy is taken seriously… and not just by regulatory bodies. Don't believe us? Research shows that organizations see a 2-7% customer churn after a data breach and 20% of employees say that their company lost a customer after they sent a misdirected email. A data breach can (and does) undermine the confidence that clients, shareholders, and partners have in an organization. Whether it's via a formal report, word-of-mouth, negative press coverage, or social media, news of lost – or even misplaced – data can drive customers to jump ship. Revenue loss. Naturally, customer churn + hefty fines = revenue loss. But, organizations will also have to pay out for investigation and remediation and for future security costs. How much? According to IBM's latest Cost of a Data Breach report, the average cost of a data breach today is $3.86 million. Damaged reputation. As an offshoot of lost customer trust and increased customer churn, organizations will – in the long-term – also suffer from a damaged reputation. Like we've said: people take data privacy seriously. That's why, today, strong cybersecurity actually enables businesses and has become a unique selling point in and of itself. It's a competitive differentiator. Of course, that means that a cybersecurity strategy that's proven ineffective will detract from your business. But, individuals may also suffer from a damaged reputation or, at the very least, will be embarrassed. For example, the person who sent the misdirected email may be labeled careless and security leaders might be criticized for their lack of controls. This could lead to…. Job loss. Unfortunately, data breaches – even those caused by a simple mistake – often lead to job losses. It could be the Chief Information Security Officer, a line manager, or even the person who sent the misdirected email. It goes to show that security really is about people. That's why, at Tessian, we take a human-centric approach and, across three solutions, we prevent human error on email, including accidental data loss via misdirected emails.
How does Tessian prevent misdirected emails? Tessian turns an organization's email data into its best defense against human error on email. Powered by machine learning, our Human Layer Security technology understands human behavior and relationships, enabling Tessian Guardian to automatically detect and prevent anomalous and dangerous activity like emails being sent to the wrong person. Importantly, Tessian's technology automatically updates its understanding of human behavior and evolving relationships through continuous analysis and learning of the organization's email network. That means that if, for example, you frequently worked with "Jim Morris" on one project but then stopped interacting with him over email, Tessian would understand that he probably isn't the person you meant to send your most recent (highly confidential) project proposal to. Crisis averted. Interested in learning more about how Tessian can help prevent accidental data loss and data exfiltration in your organization? You can read some of our customer stories here or book a demo.
Data Leakage and Exfiltration: 7 Problems Tessian Helps Solve
On Wednesday, July 29, Tessian hosted a webinar with two customers: Euromoney Institutional Investor and ERT. The topic? Data exfiltration and reduced visibility while workforces are remote. Martyn Booth, Chief Information Security Officer (CISO) at Euromoney Institutional Investor and Ted Crawford, Chief Information Officer (CIO) at ERT both offered incredible insights about how things have changed from a security perspective over the last four months and how Tessian has helped them lock down email, even before their employees started working from home. And, because Martyn and Ted are two security leaders in different industries (Financial Services and Tech/Healthcare respectively) and are based in different regions (England and The United States), they were able to share diverse opinions and experiences. Keep reading to learn more about how Tessian has helped them solve some of their biggest pain points. 7 Problems Tessian Helps Solve 1. Tessian prevents accidental data loss on email When you hear data exfiltration, what do you think of? Many of you probably thought immediately about Insider Threats and other malicious activity. But, as our customers pointed out, most incidents involving data loss are accidental. Or, as Martyn put it, are the result of "naive email usage". It could be an employee sending an email to the wrong person (we call this a misdirected email), it could be someone hitting "reply all", or it could be someone emailing a spreadsheet to their personal email account to work on over the weekend. Harmless, right? Not exactly. If these "accidents" involve sensitive information related to employees, customers, clients, or the company itself, it's considered a breach. Organizations can prevent all of the above with Tessian Guardian. This is especially important now that employees are working remotely. Why? Because the lines between peoples' personal and professional lives are blurred. Beyond that, people are distracted, stressed, and tired which, as we've shown in our latest research report The Psychology of Human Error, increases the likelihood that a mistake will happen. 2. Tessian prevents malicious data exfiltration on email While, many data loss incidents are accidental, some employees do intentionally exfiltrate data. There are a number of reasons why, but financial gain and a competitive edge are the most likely motivators. Unfortunately, with so many people being laid off, made redundant, or furloughed, many organizations have seen a spike in this type of malicious activity. But, with Tessian Enforcer, organizations' most sensitive data is kept safe. Employees attempting to email sensitive information to themselves or a suspicious third-party will receive a warning message, explaining why the email has been flagged and asking if they're sure they want to proceed. At the same time, security teams will get a notification.
Note: Instead of warning the employee and asking if they'd like to send the email anyway, security teams can easily configure Tessian to automatically quarantine emails that look like data exfiltration. Book a demo to see Tessian in action. 3. Tessian makes it easy to report security risks and communicate ROI Communicating cybersecurity ROI has historically been a real challenge for security leaders. Not with Tessian. Martyn explained how Tessian enables him to share key results with executives and demonstrate the effectiveness of not just the solution, but his overall strategy. "One of the pillars of our infrastructure strategy was to build transparency across the organization. This comes from sharing metrics. With Tessian, we can show how many alerts were picked up and, each month, we can show the risk committee that we're reducing the number of alerts. Now, are they actually interested in our preventative controls? I don't think so. But the whole point of the metrics program is to show how well (or badly) our strategy is performing. Before, they would make their decision based on cost or how much risk they thought we were going to be mitigating. It was quite subjective. We've moved that now into something more data-based. We can actually say "Well, actually, we pay x per year and, as a result of that, we're going in the right direction in terms of our risk mitigations." 4. Tessian helps organizations stay compliant Both Healthcare and Financial Services are highly regulated industries that are bound to several compliance standards beyond GDPR. That's why, for Ted, protecting sensitive clinical data and ensuring "privacy and security by design" are both paramount. "There's a lot of data that we need to protect and prevent from getting outside of the four walls of ERT," he said. "As an offshoot of GDPR in 2018, we had to classify all of the data, determine from a privacy perspective how to treat it from a sensitivity perspective, and then decide how to treat it from a security perspective. Because it's very easy to pull sensitive data and incur data loss on email, we needed a solution that would help us ensure data isn't distributed where it shouldn't go. That's why we approached Tessian." For more information about compliance in Financial Services, check out this article: Ultimate Guide to Data Protection and Compliance in Financial Services.
5. Tessian saves security teams time While essential for compliance, classifying (and re-classifying) data, monitoring movement, investigating incidents, and generating reports all take a lot of time. That's why 85% of IT leaders say rule-based DLP is admin-intensive. With Tessian, security teams don't have to do any of the above manually. This is a big selling point for Martyn, who said, "That's where we really see the value with Tessian. It takes the burden off of people in my security team." Tessian is powered by machine learning algorithms that have been trained on billions of data points. That means our solutions automatically understand what is and isn't normal behavior for individual employees and can, therefore, detect and prevent threats before they turn into incidents or breaches. No rules required. You can read more about our technology here. 6. Tessian gives security teams clear visibility of risks We've talked a lot about how Tessian detects and prevents risks. But for a solution to be really successful, it has to give security teams clear visibility of the risks in their organization. Tessian's Human Layer Security platform does both. With Tessian Human Layer Security Intelligence, our customers can easily and automatically get detailed insights into employee's actions. For example, imagine that in a single week, Tessian detects 12 different employees attempting to send sensitive information to their personal email accounts. When warned that sending the email is against company policy, nine of the employees opted to not send the email. The other three went ahead. Knowing this, security leaders can focus their efforts on the three that went ahead and offer additional, targeted training or, if necessary, they can escalate the incident to a line manager to issue a more formal warning. This also helps predict future behavior. For example, if Tessian flags that an employee has sent upwards of 20 attachments – including Intellectual Property that would be valuable to a competitor – to a recipient he or she has no previous email history with soon after being denied a raise or promotion, security teams could infer that the employee is resigning and taking company data with them. And, to prevent any further data exfiltration attempts, they can create custom filters specifically for that user, including customized warning messages or a filter that automatically blocks future exfiltration attempts. Before Tessian, this wasn't possible for Martyn. "Even if we suspected that an employee was going to go to a competitor and take data, we couldn't check. We couldn't see anything that was going up to the Cloud. It was all encrypted. The only way we would be able to see what people were emailing would be to actually go through individual emails to find ones that were problematic. We didn't have time for that," he said.
7. Tessian helps reinforce training and improve employee's security reflexes with in-the-moment warnings In the example above, three employees opted to send an email after being warned that doing so would be against company policy. But, what about the other nine? The warning message changed their behavior! It actually incentivized them to accurately mark emails as confidential or malicious if they were, in fact, confidential or malicious. This is really important. "You can't take a 'big bang' approach to data privacy awareness training. To really see employees empowered, you have to constantly reinforce training," Ted said. The bottom line: For training to be effective long-term, employees need to apply what they learn to real-world situations and be reminded of policies in-the-moment. Over time, this will help improve their security reflexes and help build a more positive security culture. Henry Trevelyan Thomas, the host of the webinar and Tessian's Head of Customer Success, summarized the benefits of this for both employees and security leaders, "This is a really productive way to help employees take accountability for how they handle data. It democratizes security and takes some of the weight off of the Chief Information Security Officer's shoulders." Tessian can help prevent data exfiltration in your organization, too Tessian turns an organization's email data into its best defense against inbound and outbound email security threats. Powered by machine learning, our Human Layer Security technology understands human behavior and relationships, enabling it to automatically detect and prevent anomalous and dangerous activity. Tessian Enforcer detects and prevents data exfiltration attempts Tessian Guardian detects and prevents misdirected emails Importantly, Tessian's technology automatically updates its understanding of human behavior and evolving relationships through continuous analysis and learning of the organization's email network. Oh, and it works silently in the background, meaning employees can do their jobs without security getting in the way. Interested in learning more about how Tessian can help prevent accidental data loss and data exfiltration in your organization? You can read some of our customer stories here or book a demo.
Pros and Cons of Phishing Awareness Training
Over the last several weeks, phishing, spear phishing, and social engineering attacks have dominated headlines. But, phishing isn't a new problem. These scams have been circulating since the mid-'90s. So, what can security leaders do to prevent being targeted? Unfortunately, not much. Hackers play the odds and fire off thousands of phishing emails at a time, hoping that at least a few will be successful. The key, then, is to train employees to spot these scams. That's why phishing awareness training is such an essential part of any cybersecurity strategy. But is phishing awareness training alone enough? Keep reading to find out the pros and cons of phishing awareness training as well as the steps security leaders need to take to level up their inbound threat protection. Still wondering how big of a problem phishing really is? Check out the latest phishing statistics for 2020.
To make this article easy-to-navigate, we'll start with a simple list of the pros and cons of phishing awareness training. For more information about each point, you can click the text to jump down on the page.
Pros of phishing awareness training Phishing awareness training introduces employees to threats they might not be familiar with While people working in security, IT, or compliance are all-too-familiar with phishing, spear phishing, and social engineering, the average employee isn't. The reality is, they might not have even heard of these terms. That means phishing awareness training is an essential first step. To successfully spot a phish, they have to know they exist. By showing employees examples of attacks – including the subject lines to watch out for, a high-level overview of domain impersonation, and the types of requests hackers will generally make – they'll immediately be better placed to identify what is and isn't a phishing attack. Looking for resources to help train your employees? Check out this blog with a shareable PDF. It includes examples of phishing attacks and reasons why the email is suspicious. Phishing awareness training can teach employees more about existing policies and procedures Again, showing employees what phishing attacks look like is step one. But ensuring they know what to do if and when they receive one is an essential next step and is your chance to remind employees of existing policies and procedures. For example, who to report attacks to within the security or IT team. Importantly, though, phishing awareness training should also reinforce the importance of other policies, specifically around creating strong passwords, storing them safely, and updating them frequently. After all, credentials are the number one "type" of data hackers harvest in phishing attacks. Phishing awareness training can help security leaders identify particularly risky and at-risk employees By getting teams across departments together for training sessions and phishing simulations, security leaders will get a birds' eye view of employee behavior. Are certain departments or individuals more likely to click a malicious link than others? Are senior executives skipping training sessions? Are new-starters struggling to pass post-training assessments? These observations will help security leaders stay ahead of security incidents, can inform subsequent training sessions, and could help pinpoint gaps in the overall security framework.
Phishing awareness training can help satisfy compliance standards While you can read more about various compliance standards – including GDPR, CCPA, HIPAA, and GLBA – on our compliance hub, they all include a clause that outlines the importance of implementing proper data security practices. What are "proper data security practices?" This criterion has – for the most part – not been formally defined. But, phishing awareness training is certainly a step in the right direction and demonstrates a concerted effort to secure data company-wide. Phishing awareness training can help foster a strong security culture In the last several years (due in part to increased regulation) cybersecurity has become business-critical. But, it takes a village to keep systems and data safe, which means accountability is required from everyone to make policies, procedures, and tech solutions truly effective. That's why creating and maintaining a strong security culture is so important. While this is easier said than done, training sessions can help encourage employees – whether in finance or sales – to become less passive in their roles as they relate to cybersecurity, especially when gamification is used to drive engagement. You can read more about creating a positive security culture on our blog. Phishing awareness training can enable employees to spot scams in their personal lives, too The point of phishing awareness training is to prevent successful attacks in the workplace. But, it's important to remember that phishing attacks are targeted at consumers, too. That's why the most frequently impersonated brands are household names like Netflix and Facebook. Why does this matter? Because phishing attacks have serious consequences, and not just for larger organizations. If an employee was scammed in a consumer attack, they could lose thousands of dollars or even have their identity stolen. It's hard to imagine a world in which this wouldn't affect their work. The bottom line: prevention is better than cure and knowledge is power. Phishing awareness training won't just protect your organization's data and assets, it'll empower your people to protect themselves outside of the office, too.
Cons of phishing awareness training Phishing awareness training can't prevent human error While phishing awareness training will help employees spot phishing scams and make them think twice before clicking a link or downloading an attachment, it's not a silver bullet. Even the most security-conscious and tech-savvy employees can – and do – fall for phishing attacks. Case in point: Employees working in the tech industry are the most likely to click on links in phishing emails, with nearly half (47%) admitting to having done it. This is 22% higher than the average across all industries. As the saying goes, to "err is human". Phishing awareness training can't evolve as quickly as threats do Hackers think and move quickly and are constantly crafting more sophisticated attacks to evade detection. That means that training that was relevant three months may not be today. We only have to look at the spike in COVID-19 themed phishing attacks starting in March for proof. Prior to the outbreak of the pandemic, very few phishing awareness programs would have trained employees to look for impersonations of the World Health Organization, for example. Likewise, impersonations of collaboration tools like Zoom took off as soon as workforces shifted to remote-working. (Click here for more real-life examples of COVID-19 phishing emails.) What could be next? Phishing awareness training has hidden costs According to Mark Logsdon, Head of Cyber Assurance and Oversight at Prudential, there are three fundamental flaws in training: it's boring, often irrelevant, and expensive. We'll cover the first two below but, for now, let's focus on the cost. Needless to say, the cost of training and simulation software varies vendor-by-vendor. But, the solution itself is far from the only cost to consider. What about lost productivity? Imagine you have a 1,000-person organization and, as a part of an aggressive inbound strategy, you've opted to hold training every quarter. Training lasts, on average, three hours. That's 12,000 lost hours a year. While – yes – a successful attack would cost more, we can't forget that phishing awareness training alone doesn't work. (See point 1: Phishing awareness training can't prevent human error.)
Phishing awareness training isn't targeted (or engaging) enough Going back to what Mark Logsdon said: Training is boring and often irrelevant. It's easy to see why. You can't apply one lesson to an entire organization – whether it's 20 people or 20,0000 – and expect it to stick. It has to be targeted based on age, department, and tech-literacy. Age is especially important. According to Tessian's latest research, nearly three-quarters of respondents who admitted to clicking a phishing email were aged between 18-40 years old. In comparison, just 8% of people over 51 said they had done the same. However, the older generation was also the least likely to know what a phishing email was. !function(e,t,s,i){var n="InfogramEmbeds",o=e.getElementsByTagName("script"),d=o[0],r=/^http:/.test(e.location)?"http:":"https:";if(/^\/{2}/.test(i)&&(i=r+i),window[n]&&window[n].initialized)window[n].process&&window[n].process();else if(!e.getElementById(s)){var a=e.createElement("script");a.async=1,a.id=s,a.src=i,d.parentNode.insertBefore(a,d)}}(document,0,"infogram-async","//e.infogram.com/js/dist/embed-loader-min.js"); Jeff Hancock, the Harry and Norman Chandler Professor of Communication at Stanford University and expert in trust and deception, explained how tailored training programs could help. "A one-size-fits-all approach won't work. Different generations have grown up with tech in different ways, and security training needs to reflect this. That's not to say that we should think that people over 50 are tech-illiterate, though. Businesses need to consider what motivates each age group and tailor training accordingly." "Being respected at work is incredibly important to an older generation, so telling them that they don't understand something isn't an effective way to educate them on the threats. Instead, businesses should engage them in a conversation, helping them to identify how their strengths and weaknesses could be used against them in an attack." "Many younger employees, on the other hand, have never known a time without the internet and they don't want to be told how to use it. This generation has a thirst for knowledge, so teach them the techniques that hackers will use to target them. That way, when they see a scam, they'll be able to unpick it and recognize the tactics being used on them." Phishing awareness training can't force employees to care about cybersecurity Unfortunately, the average employee is less focused on cybersecurity and more focused on getting their jobs done. That's why one-third (33%) rarely or never think about security and work and over half (54%) of employees say they'll find a workaround if security software or policies prevent them from doing their job. While – yes – security leaders can certainly reinforce the importance of software and policies, training alone won't help control employee's behavior or inspire every single person to become champions of cybersecurity. Phishing awareness can't change quick-to-click company cultures It's widely accepted that time pressure negatively impacts decision accuracy. But did you know that individuals who are expected to respond to emails quickly are also the most likely to click on phishing emails? !function(e,t,s,i){var n="InfogramEmbeds",o=e.getElementsByTagName("script"),d=o[0],r=/^http:/.test(e.location)?"http:":"https:";if(/^\/{2}/.test(i)&&(i=r+i),window[n]&&window[n].initialized)window[n].process&&window[n].process();else if(!e.getElementById(s)){var a=e.createElement("script");a.async=1,a.id=s,a.src=i,d.parentNode.insertBefore(a,d)}}(document,0,"infogram-async","//e.infogram.com/js/dist/embed-loader-min.js"); It makes sense. If you're rushing to read and fire off emails – especially when you're working off of laptops, phones, and even watches – you're more likely to make mistakes.
Should I create a phishing awareness training program? The short answer: Absolutely. Phishing awareness training programs can help teach employees what phishing is, how to spot phishing emails, what to do if they're targeted, and the implications of falling for an attack. But, as we've said, training isn't a silver bullet. It will curb the problem, but it won't prevent mistakes from happening. That's why security leaders need to bolster training with technology that detects and prevents inbound threats. That way, employees aren't the last line of defense. But, given the frequency of attacks year-on-year, it's clear that spam filters, antivirus software, and other legacy security solutions aren't enough. That's where Tessian comes in. How does Tessian detect and prevent targeted phishing attacks? Tessian fills a critical gap in security strategies that SEGs, spam filters, and training alone can't. By learning from historical email data, Tessian's machine learning algorithms can understand specific user relationships and the context behind each email. This allows Tessian Defender to detect a wide range of impersonations, spanning more obvious, payload-based attacks to difficult-to-spot social-engineered ones like CEO Fraud and Business Email Compromise. Once detected, real-time warnings are triggered and explain exactly why the email was flagged, including specific information from the email. (See below.) This is an important function. Why? Because, according to Jeff, "People learn best when they get fast feedback and when that feedback is in context,"
These in-the-moment warnings reinforce training and policies and help employees improve their security reflexes over time. To learn more about how tools like Tessian Defender can prevent spear phishing attacks, speak to one of our experts and request a demo today.
HLS Intelligence
Tessian Explained
HLS On-Demand
Tessian Careers
Follow Tessian
Copyright © 2021 Tessian Limited. All Rights Reserved. Company registered number 08358482.