What We Do
How we do it
Resources
SECURITY ADVISORIES
Jan 13, 2022
GootLoader Hackers Are Compromising Employees of Law and Accounting Firms, Warns eSentire
GootLoader Gang Launches Wide-Spread Cyberattacks Enticing Legal and Accounting Employees to Download Malware eSentire, the industry’s leading Managed Detection and Response (MDR) cybersecurity provider, is warning law and accounting firms of a wide-spread GootLoader hacker campaign. In the past three weeks and as recently as January 6, eSentire’s threat hunters have intercepted and shut down…
Read More
View all Advisories →
Company
ABOUT ESENTIRE
About Us
eSentire is The Authority in Managed Detection and Response Services, protecting the critical data and applications of 1000+ organizations in 70+ countries from known and unknown cyber threats. Founded in 2001, the company’s mission is to hunt, investigate and stop cyber threats before they become business disrupting events.
Read about how we got here
Leadership Work at eSentire
LATEST PRESS RELEASE
Oct 28, 2021
Telarus and eSentire Expand Partnership to Safeguard Enterprises Globally Against Business Disrupting Ransomware and Zero-Day Attacks
London, UK and Sydney, Australia– Oct. 28, 2021 - eSentire, recognized globally as the Authority in Managed Detection and Response (MDR), today announces the expansion of its partnership with Telarus, the largest privately-held distributor of business cloud infrastructure and contact centre services. Building on their mutual success across North America, Telarus will bring eSentire’s Managed…
Read More
Partners
PARTNER PROGRAM
Partners
Our award-winning partner program offers financial rewards, sales and marketing tools and personalized training. Accelerate your business and grow your revenue by offering our world-class Managed Detection and Response (MDR) services.
Learn about our Partner Program
PARTNER RESOURCES
Apply today to partner with the Authority in Managed Detection and Response.
Login to the Partner Portal for resources and content for current partners.
Search
Resources
Blog — Dec 21, 2021

MANAGING CYBER RISK PODCAST SERIES

Ep. 7: Security Awareness Training and Phishing Testing

Speak With A Security Expert Now

Cybersecurity is not an IT problem to solve—it's a business risk to manage. In the Managing Cyber Risk podcast series, Mark Sangster, Vice President and Industry Security Strategist with eSentire, and Cybercrime Magazine’s Hillarie McClure lead conversations with cybersecurity experts, using the dollars-and-cents language of the C-suite to expose the issues, challenges and pitfalls which are often obscured by ones and zeroes.

Want to listen to the full episode instead? Click here.

Most of the devastating cyberattacks begin with a phishing email that tricks a user into aiding the threat actor. To increase resilience against this tactic, organizations turn to security awareness training and phishing testing. Often, these testing programs are combined into Phishing and Security Awareness Training (PSAT), typically structured as a set of lessons, tests, and simulations designed to teach employees how to avoid falling prey to phishing attempts and other cybersecurity threats.

PSAT programs recognize that behind all the technology that is often at the center of cybersecurity discussions, there are people—and those people can be manipulated and tricked by clever cybercriminals. But PSAT programs are not created equal, nor are they as simple as many people think, which means many organizations are not getting the results they want (or need).

As Mark Sangster, our VP Industry Security Strategy, put it in a recent Managing Cyber Risk podcast, “PSAT is something every company is likely doing [so the question becomes,] are they doing what’s necessary and moving the needle?”

Moving beyond a compliance mindset

Companies in highly regulated industries (e.g., healthcare and finance) or those that have a large number of professionals licensed by a governing body (e.g., doctors, accountants, engineers) are more likely to have a formal PSAT program as part of their compliance activities.

However, PSAT should be about business outcomes—about reducing risk and the consequences associated with cybersecurity events—and a compliance mindset can create a false sense of security.

Moreover, a risk-based approach to cybersecurity allows business leaders to direct investments in the most effective way with the goal of reducing risk over time. In a world of scarce resources, this approach leads to superior cybersecurity outcomes when compared to maturity-based or compliance-based approaches.

In Mark’s words, “When it comes to a successful program, it’s not about an hour of class time a year or making up a couple of fake phishing emails. You really need an integrated approach that’s manageable and that provides information you can feed up the chain to the C-suite or your board to demonstrate that you are delivering value—that you are reducing risk.”

Why do so many PSAT programs fail to achieve the desired outcomes?

Perhaps the biggest reason why many PSAT initiatives don’t deliver the desired results is because they start with an underlying assumption that users are irresponsible or stupid, and this fundamentally flawed premise shapes ‘training’ that is little more than definitions, jokes, and generic examples that are easy to spot. All that such training achieves is reiterating the stereotype that victims are at fault.

While it’s all-too-common to scapegoat employees for their mistakes, or to act like threats are self-evidently obvious, the reality is that cybercriminals are extremely skilled at disguising their lures. So, the first step in conducting effective Phishing and Security Awareness Training is to recognize and accept that:

Look at your employees as an important part of the solution to a problem that has claimed many sophisticated victims and treat your team with the respect that is warranted of such a crucial role. Then, make sure your team is aware of the six common causes of failure that have undermined many PSAT initiatives and ensure you don’t fall victim to them.

What makes a PSAT program effective?

It’s critical that PSAT programs leverage realistic threat scenarios that foster context-relevant (e.g., tailored to your industry and risks) security awareness, rather than using commoditized and easy-to-spot templates that are increasingly relics of the past.

Consider the structure of the program and look for programs that:

Effective PSAT programs deconstruct the tools, techniques, and procedures (TTPs) that cybercriminals employ using relevant examples.

Mark speaks with many business leaders, and he often must remind them that PSAT is more important and more involved than they initially perceive it to be.

“This isn’t a simple thing to do. A lot of people in the security world think it is: buy a tool, choose from some templates, do a presentation once a year. It’s far more than that—it’s about creating a comprehensive program and demonstrating that you’re protecting the business.”

Remember, PSAT is about real business outcomes, not simply checking a box.

Learn more about implementing your own PSAT program

Listen to the full Security Awareness Training and Phishing Testing episode of the Managing Cyber Risk podcast series as Mark Sangster and Hillarie McClure discuss cybersecurity awareness training and phishing testing, how these help improve business resiliency by reducing the risks associated with human-targeted attacks, commonly held misconceptions about these important programs, and much more.

View Most Recent Blogs
eSentire
eSentire

eSentire is the Authority in Managed Detection and Response, protecting the critical data and applications of 1000+ organizations in 70+ countries from known and unknown cyber threats. Founded in 2001, the company’s mission is to hunt, investigate and stop cyber threats before they become business disrupting events. Combining cutting-edge machine learning XDR technology, 24/7 Threat Hunting, and proven security operations leadership, eSentire mitigates business risk, and enables security at scale. The Team eSentire difference means enterprises are protected by the best in the business with a named Cyber Risk Advisor, 24/7 access to SOC Cyber Analysts & Elite Threat Hunters, and industry-leading threat intelligence research from eSentire’s Threat Response Unit (TRU). eSentire provides Managed Risk, Managed Detection and Response and Incident Response services. For more information, visit www.esentire.com and follow @eSentire.