Cyber risk and advisory programs that identify security gaps and build strategies to address them.
MDR that provides improved detection, 24/7 threat hunting, end-to-end coverage and most of all, complete Response.
Our team delivers the fastest response time in the industry. Threat suppression within just 4 hours of being engaged.
Be protected by the best from Day 1.
24/7 Threat Investigation and Response.
Expert hunting, research and content.
Defend brute force attacks, active intrusions and unauthorized scans.
Safeguard endpoints 24/7 by isolating and remediating threats to prevent lateral spread.
Investigation and enhanced threat detection across multi-cloud or hybrid environments.
Configuration escalations, policy and posture management.
Detects malicious insider behavior leveraging Machine Learning models.
Join Tim Segato, Director, Product Management and Ryan Westman, Manager,…
Join us for a live security brefing with (ISC)2 members.
Ask questions and hear from Cybersecurity experts from eSentire,…
Cybersecurity is not an IT problem to solve—it's a business risk to manage. In the Managing Cyber Risk podcast series, Mark Sangster, Vice President and Industry Security Strategist with eSentire, and Cybercrime Magazine’s Hillarie McClure lead conversations with cybersecurity experts, using the dollars-and-cents language of the C-suite to expose the issues, challenges and pitfalls which are often obscured by ones and zeroes.
Want to listen to the full episode instead? Click here.
Most of the devastating cyberattacks begin with a phishing email that tricks a user into aiding the threat actor. To increase resilience against this tactic, organizations turn to security awareness training and phishing testing. Often, these testing programs are combined into Phishing and Security Awareness Training (PSAT), typically structured as a set of lessons, tests, and simulations designed to teach employees how to avoid falling prey to phishing attempts and other cybersecurity threats.
PSAT programs recognize that behind all the technology that is often at the center of cybersecurity discussions, there are people—and those people can be manipulated and tricked by clever cybercriminals. But PSAT programs are not created equal, nor are they as simple as many people think, which means many organizations are not getting the results they want (or need).
As Mark Sangster, our VP Industry Security Strategy, put it in a recent Managing Cyber Risk podcast, “PSAT is something every company is likely doing [so the question becomes,] are they doing what’s necessary and moving the needle?”
Companies in highly regulated industries (e.g., healthcare and finance) or those that have a large number of professionals licensed by a governing body (e.g., doctors, accountants, engineers) are more likely to have a formal PSAT program as part of their compliance activities.
However, PSAT should be about business outcomes—about reducing risk and the consequences associated with cybersecurity events—and a compliance mindset can create a false sense of security.
Moreover, a risk-based approach to cybersecurity allows business leaders to direct investments in the most effective way with the goal of reducing risk over time. In a world of scarce resources, this approach leads to superior cybersecurity outcomes when compared to maturity-based or compliance-based approaches.
In Mark’s words, “When it comes to a successful program, it’s not about an hour of class time a year or making up a couple of fake phishing emails. You really need an integrated approach that’s manageable and that provides information you can feed up the chain to the C-suite or your board to demonstrate that you are delivering value—that you are reducing risk.”
Perhaps the biggest reason why many PSAT initiatives don’t deliver the desired results is because they start with an underlying assumption that users are irresponsible or stupid, and this fundamentally flawed premise shapes ‘training’ that is little more than definitions, jokes, and generic examples that are easy to spot. All that such training achieves is reiterating the stereotype that victims are at fault.
While it’s all-too-common to scapegoat employees for their mistakes, or to act like threats are self-evidently obvious, the reality is that cybercriminals are extremely skilled at disguising their lures. So, the first step in conducting effective Phishing and Security Awareness Training is to recognize and accept that:
Look at your employees as an important part of the solution to a problem that has claimed many sophisticated victims and treat your team with the respect that is warranted of such a crucial role. Then, make sure your team is aware of the six common causes of failure that have undermined many PSAT initiatives and ensure you don’t fall victim to them.
It’s critical that PSAT programs leverage realistic threat scenarios that foster context-relevant (e.g., tailored to your industry and risks) security awareness, rather than using commoditized and easy-to-spot templates that are increasingly relics of the past.
Consider the structure of the program and look for programs that:
Effective PSAT programs deconstruct the tools, techniques, and procedures (TTPs) that cybercriminals employ using relevant examples.
Mark speaks with many business leaders, and he often must remind them that PSAT is more important and more involved than they initially perceive it to be.
“This isn’t a simple thing to do. A lot of people in the security world think it is: buy a tool, choose from some templates, do a presentation once a year. It’s far more than that—it’s about creating a comprehensive program and demonstrating that you’re protecting the business.”
Remember, PSAT is about real business outcomes, not simply checking a box.
Listen to the full Security Awareness Training and Phishing Testing episode of the Managing Cyber Risk podcast series as Mark Sangster and Hillarie McClure discuss cybersecurity awareness training and phishing testing, how these help improve business resiliency by reducing the risks associated with human-targeted attacks, commonly held misconceptions about these important programs, and much more.
eSentire is the Authority in Managed Detection and Response, protecting the critical data and applications of 1000+ organizations in 70+ countries from known and unknown cyber threats. Founded in 2001, the company’s mission is to hunt, investigate and stop cyber threats before they become business disrupting events. Combining cutting-edge machine learning XDR technology, 24/7 Threat Hunting, and proven security operations leadership, eSentire mitigates business risk, and enables security at scale. The Team eSentire difference means enterprises are protected by the best in the business with a named Cyber Risk Advisor, 24/7 access to SOC Cyber Analysts & Elite Threat Hunters, and industry-leading threat intelligence research from eSentire’s Threat Response Unit (TRU). eSentire provides Managed Risk, Managed Detection and Response and Incident Response services. For more information, visit www.esentire.com and follow @eSentire.