In today’s interview we have Eyal Benishti, the Founder and CEO of Ironscales, a leading email security platform. We will learn their story, and then look into the latest cybersecurity trends, the current state of cybersecurity awareness, and get his advice on the best tips and tools to prevent phishing attacks as well as all the other main cyber threats.
What’s the story behind Ironscales: How did it all start, and how has it changed during the years?
Eyal Benishti started IRONSCALES back in 2014 because he was constantly being asked by coworkers if a specific email was a phish or not and saw an opportunity to create software that could train end users on how to spot a phish. This quickly expanded into building a solution that could detect & remediate phishing attacks by incorporating the power of AI/Machine Learning with Human intelligence. In the ensuing years IRONSCALES has made significant advances in our detection & remediation capabilities, grew our security testing & training functionality and have expanded our anti-phishing defenses to meet the emerging threat of phishing attacks expanding beyond email.
What are the key features of your email security platform that makes it different?
IRONSCALES is the only email security platform that integrates both machines and humans into the solution. Our AI/ML does much of the heavy lifting with detecting and remediating around 99% of advanced phishing attacks. For the other 1% we incorporate what we call the “human element”, which consists of phishing simulation testing & security awareness training for end users, dynamic banners that are inserted directly into emails that our AI has determined to be suspicious that encourages the end user to consider whether or not to open the email or to report it via a button in their email client and finally we leverage crowdsourced threat intelligence from our 7,000+ customers who are all reporting suspicious new phishing attacks in the wild into our platform, which we can then evaluate and, if determined to be phishing attacks, automatically remove the email from all of our customers’ inboxes.
Some of our competitors offer variations of what we offer, but typically as a bolt-on solution that isn’t integrated.
October was cybersecurity awareness month. What do you think about the way online media are spreading cybersecurity awareness and what can be improved?
The media continues to perpetuate the myth that phishing emails are coming from people in hoodies sitting in their basement on one extreme and on the other it’s some top secret government agency filled with hackers in a nondescript building somewhere across the world. Reality is somewhere in between. Phishing organizations often look and act like a normal for-profit business would, including regular employee shifts, company strategies/KPIs and interacting with other companies within their own supply chain.
The good news is that in recent years the media has slowed down with the hype and started to focus on cybersecurity in a manner similar to what they would with other areas like politics, global events, etc. They’re also doing a decent job of communicating that phishing is a problem that impacts everyone and not a problem that you can escape once you leave the office for the day.
Can you share your top tips for businesses to protect their websites and employees from hackers?
- Avoid clicking on links and attachments in any email that you’re even the slightest bit suspicious of. And even then, you can always pick up the phone and call the supposed sender to verify that they sent the email.
- Don’t react to emails that convey strong urgency or emotion. Phishers try to use tactics like creating panic (your package has been delayed), stress (the IRS is auditing you unless you do xyz), anger (can you believe that [insert politician] did [insert action here]…donate now to stop them!) and even sudden happiness (you won the prize!) to get recipients to take an action.
- Protect your accounts (business and personal) with equal seriousness. Use strong passwords and change them often. Leverage two-factor/multi-factor authentication where able.
- Assume the Phish, and make sure you are ready to respond to phishing incidents at the mailbox level before it is becoming a bigger issue, automate your processes as much as possible.
- Equip your users with the tools and the knowledge to detect and report suspicious emails
- Create a cyber-aware culture, where employees understand they are part of the solution, the company’s last layer of defense, empower and encourage them to take an active part in the business defense strategy.
What is your suggested course of action for those who fall victims of a phishing attack?
If it happened at work, tell your Security team immediately. Don’t try to hide it. The sooner the security team knows, the faster they can investigate and take the necessary actions to keep the damage to a minimum.
If it happened in your personal life and it was financial-related, reach out to the three major credit bureaus to request a credit freeze. You should also consider enrolling in one of the many credit/dark web monitoring services that are available so that you’re identified when your personal details have been spotted. Finally, you reset all your passwords and consider adding two-factor/multi-factor authentication to all of the web-based services you use where you’re sharing personal details over the internet. Nearly every bank, healthcare provider & social media platform offers this as an option at login.
Is There Any Recent Cyber-Attack That Concerned You More Than Others?
The recent Uber attack was concerning because of the use of a relatively new type of attack called a “Nag Attack”, in which an Uber employee received multiple texts in a short amount of time from the threat actor until he gave up and clicked on the link, which ultimately led to the massive breach. Another troubling attack was just announced today by Dropbox. It appears that one of their employees fell victim to an extremelywell-targeted spear phishing attack. Even with training and experience, phishing attacks are so believeable these days that anyone can fall for them.
What cybersecurity trends do you think will be crucial in the near future?
Within our segment of the security market, we are starting to see the rapid expansion of phishing attacks beyond email and into collaboration tools like Microsoft Teams, messaging platforms like WhatsApp and Telegram and even into messaging within social media apps like Facebook and LinkedIn. Being able to develop technology to detect and remediate these threats using AI/ML as well as ensuring users are educated about this emerging trend will be critical to keeping the phishing problem from getting worse than it already is.
And what about your future? What is next for IRONSCALES?
The IRONSCALES roadmap encompasses a broad set of new capabilities related to better automations, incident management and AI+Human integrations.
IRONSCALES will extend its platform to support outbound protection, preventing sensitive data leaks due to human error or an account takeover.
On the awareness front, IRONSCALES will add smart, autonomous simulation and training campaigns allowing low touch, personalized simulation and training based on ML and real user behavior and real life attacks.
IRONSCALES is also planning to expand its ICMS offering by supporting additional messaging platforms like Slack, WhatsApp and Telegram.