The Top 10 Business Email Compromise (BEC) Protection Solutions
Discover the top solutions to help you protect your organization against business email compromise attacks.
Written by Alex Zawalnyski
Technical Review by Craig MacAlpine
- 1.
-
2.
Agari
-
3.
Avanan
-
4.
Barracuda Total Email Protection
-
5.
Cofense
Business Email Compromise (BEC) is a form of phishing that impersonates a brand, in order to make their requests seem more authentic and trustworthy. By imitating a known and reputable brand, users are more likely to share information that they know to be sensitive, more readily.
Where BEC attacks are concerned, the victim is not limited to the party that is tricked into sharing sensitive information, but also the organization who is impersonated. If your brand becomes associated with phishing and other types of attack, your legitimate messaging and communication may be questioned. You may lose customers due to your credibility and trustworthiness, not instilling enough confidence in the current and potential customers.
BEC is a diverse and complicated issue to resolve. As such, there is not one single solution or process can eliminate the risk, but a series of different solutions and approaches that increase your chances of combating the threat.
In this guide, we’ll cover the top solutions to help prevent your organization falling victim to BEC attacks. The platforms listed in this article address BEC from several different perspectives, including email spoofing, credential theft, and phishing. The list includes products that can be defined as Secure Email Gateways (SEGs), firewalls, and user training platforms. It is through taking a broad and comprehensive approach that you have the best chance of eliminating the threat completely.
Based in San Francisco, California, Abnormal Security provides comprehensive protection against the full spectrum of email attacks, including business email compromise, phishing, malware, ransomware, social engineering, as well as spam and graymail. The platform can also automate your security operations to streamline workflows and reduce total spend.
Abnormal allows you to prevent harmful emails from reaching your users. This reduces the chances of business email compromise attacks, supply chain fraud, and credential phishing attempts. The solution also has the capability to detect account takeover attacks by monitoring normal behavior and flagging suspicious activities. The platform’s analytics capabilities enable it to assess your security posture and make suggestions of how this can be improved. Reports can be automated for auditing and compliance purposes.
The platform can ingest data from sources other than email to give you comprehensive security; this includes Slack, Microsoft 365, and Active Directory, amongst others. The platform unifies data from these sources to provide clear and concise intelligence regarding users and threats. We would recommend Abnormal for organizations of all sizes that need a comprehensive and agile email and communications security tool.
Agari
Agari is an email security provider that helps protect enterprises worldwide against a range of digital and cyber threats. Agari’s cloud-based suite of products includes phishing and BEC defense, impersonation protection, and comprehensive threat reporting and analysis. Their expertise extends from their BEC-focused counterintelligence research group, the Agari Cyber Intelligence Division (ACID).
Agari Phishing Defense works to inspect and analyze inbound emails for anomalous behavior and indicators of compromise, including domain spoofing and lookalike domains. The solution blocks malicious emails from reaching user inboxes. Agari’s products also shield against vendor email compromise by learning and modeling third-party identities and monitoring abnormal activity. The Agari Active Defense solution delivers actionable insights, threat visibility, and robust reporting, thereby providing comprehensive protection against BEC attacks. The solution is compatible with Microsoft 365, Microsoft Exchange, and Google Workspace and integrates with platforms like Azure Sentinel, Splunk, and Palo Alto Networks.
Users appreciate Agari’s ease of use and excellent customer support, along with the included onboarding and training services. The platform is recommended for enterprise organizations from various industries seeking advanced BEC protection coupled with analytics and intelligence feeds.
Agari
Avanan
Avanan is a cloud-based platform providing email and collaboration tools security for Microsoft 365, Google Workspace, Slack, and Dropbox. Advanced AI technology enables Avanan to continuously scan inbound emails for signs of fraud, impersonation, and other anomalies by building custom threat profiles using communication patterns, employee relationships, and historical emails. The platform works alongside default email security solutions to catch threats that might go undetected, such as BEC, account compromise, phishing, and data leakage.
Avanan utilizes contextual analysis, anomaly detection, and its anti-phishing algorithm, Smart-Phish, to analyze emails in real time and detect BEC and employee impersonation. The solution also identifies account compromise by monitoring suspicious activity across the email network and cloud applications. This includes unrecognized logins and multiple password resets, and can automatically lock out suspicious users based on configured policies.
The Software-as-a-Service solution is easy to install via API, requiring no change to MX records, making it simple to use, reliable, and scalable. Avanan is well-suited for organizations of all sizes using Microsoft 365/Exchange or Google Workspace and is designed to reinforce existing email security stacks by detecting threats that might evade traditional defenses. Real-time reporting allows IT managers to analyze every aspect of a threat and gain a deeper understanding of potential risks.
Avanan
Barracuda offers a Total Email Protection portfolio, which provides all-inclusive protection against 13 different email threats, including spear phishing, Business Email Compromise (BEC), and account takeover. This comprehensive security solution combines a Secure Email Gateway (SEG), AI-driven threat detection, user awareness training, and automated remediation to achieve robust email security. Barracuda Sentinel is a component that utilizes AI for detecting impersonation and malicious activities, while PhishLine offers user awareness training and reporting.
Barracuda Total Email Protection uses Sentinel’s advanced AI capabilities to analyze user communication patterns and create an identity graph. This serves as a baseline to detect anomalies such as unusual requests, unrecognizable contacts, and BEC-related language. The platform automatically flags and removes suspicious emails. PhishLine delivers engaging, updated user awareness training materials and customizable simulated phishing campaigns, as well as user behavior reporting. High-risk employees, such as those in finance, HR, and IT, can be identified and given tailored training through PhishLine.
Rated highly for its effectiveness and ease of use, Barracuda Total Email Protection serves as a comprehensive email security and awareness training solution. Sentinel employs API-based deployment, integrating swiftly with users’ inboxes. The portfolio is designed for mid-sized and enterprise organizations seeking all-in-one protection against email threats like spear phishing, BEC, and account compromise.
Cofense
Cofense is a leading provider of advanced phishing detection and response solutions, designed to protect organizations from phishing, BEC, and other email-related attacks. The Cofense suite combines security awareness training and phishing simulations to educate employees on how to identify and respond to threats effectively, in addition to automated tools for triaging and addressing reported threats.
The Cofense platform includes a user training course, where employees learn to identify and react to various types of phishing and BEC attacks. Alongside this training, organizations can use simulated phishing emails to mimic real-world threats and test employees’ knowledge. Employees can then use an email reporting plugin to report both suspicious simulated and genuine emails. Cofense also offers automated triage, threat analysis, and quarantine capabilities based on established policies.
Cofense’s phishing detection and response platform is compatible with Microsoft 365 email protection and Google Workspace. It is praised by its users for its ease of use, reliability, and flexibility. This solution is suitable for companies of different sizes and industries looking to protect themselves against email threats through engaging awareness training and automated detection and response tools.
Cofense
Darktrace
Darktrace is a cybersecurity company that provides advanced email security solutions to protect businesses from various threats such as phishing, supply chain attacks, Business Email Compromise (BEC), and accidental data loss. Darktrace’s email security offering, Darktrace/Email, employs a self-learning approach that adapts to ever-evolving threats by understanding what is considered ‘normal’ behavior for each employee and detecting anomalies in both inbound and outbound communications.
To offer comprehensive protection, Darktrace/Email not only focuses on securing email, but also extends its capabilities to a range of SaaS applications and devices on the network. This 360° user understanding allows the solution to take targeted actions, such as neutralizing threats while repairing or allowing unusual but safe emails. Darktrace/Email also communicates directly with end-users to explain its actions and takes employee feedback into account to improve its AI-driven detection capabilities.
In addition to safeguarding against cyber threats, Darktrace/Email helps boost productivity by reducing non-productive mail, such as unwanted cold calls, spam, and newsletters. As a result, employees can focus their time on important tasks and drive business growth. Darktrace/Email is an effective solution for combating a wide range of email-related threats, including ransomware, which often begins with a successful phishing attack. By providing multi-stage protection, Darktrace ensures that organizations can prevent threats from developing, before resolution becomes even more complex.
Darktrace
Huntress
Huntress is a managed security platform designed to secure small and mid-market businesses by focusing on essential cybersecurity measures. The platform works directly with IT providers and resellers, making security simple and accessible for businesses. Huntress detects threats, with its team of threat hunters able to analyze and respond to these threats, providing users with actionable incident reports.
The Huntress dashboard offers a comprehensive view of active incidents and investigations, enabling even non-security professionals to respond to cyber threats effectively. The platform includes features such as endpoint protection, detection, and response capabilities, supported by the ThreatOps team. This combination of features enhances businesses’ cybersecurity measures.
Huntress works by detecting attackers who abuse legitimate applications or aim to deploy malware and ransomware. The platform eliminates persistent footholds on Windows and Mac, enables earlier detection of potential ransomware incidents, and optimizes frontline protection with Microsoft Defender. Additionally, its managed Endpoint Detection and Response (EDR) and 24/7 Security Operations Center (SOC) help to evict hackers faster.
With detailed summaries and customizable reports, businesses can accurately measure and articulate the value they gain from the Huntress managed security platform. This platform helps to boost cybersecurity knowledge and grow businesses by developing employee security awareness through training solutions.
Huntress
IRONSCALES
IRONSCALES is a cloud-based email security and anti-phishing provider that utilizes AI and human intelligence to offer comprehensive email protection and user security awareness training. The platform safeguards organizations against various threats, such as internal and external phishing attacks, CEO and employee impersonation, supply chain attacks, and invoice fraud.
Key features of the IRONSCALES platform include inbound email filtering, URL scanning, DMARC, and anomaly detection. The system learns employee habits, communication history, and relationships to identify and prevent impersonation and fraud. IRONSCALES also provides engaging training modules and customized phishing simulation emails, helping users recognize and combat phishing attacks.
Easily integrating with Microsoft 365, Google Workspace, and Exchange, IRONSCALES is quick to deploy, does not require MX-record configuration, and is highly rated by users for its intuitiveness and ease-of-use. The solution is suitable for SMBs as well as enterprise organizations seeking advanced email security, BEC protection, and personalized phishing simulations.
IRONSCALES
Mimecast is a well-respected email security provider that offers a comprehensive, cloud-based security platform through a single subscription service. Their Email Security With Targeted Threat Protection products are designed to secure organizations against Business Email Compromise (BEC) using an array of advanced features, such as a secure email gateway, impersonation protection, and internal email protection. Powered by the Mimecast Security Operations Centre (MSOC), Mimecast analyzes billions of emails each month to keep users up-to-date with emerging threats.
Mimecast’s email security products provide protection across desktop and mobile devices, as well as personal devices. The secure email gateway combines detection engines, threat intelligence, and policy management, along with DMARC and email quarantine. Mimecast Impersonation Protect scans inbound emails in real time for suspicious content and domain spoofing. For additional security, organizations can utilize Mimecast Awareness Training to educate and test employees on email-based threats. The platform can be run on Amazon Web Services or Mimecast’s native cloud platform, Mime|OS.
Users often praise Mimecast’s platform for its reliability, effectiveness, and ease of management. Mimecast offers high-quality support, making it a suitable option for enterprise organizations across various industries seeking robust email security and BEC protection, as well as user awareness training.
Proofpoint is a leading cybersecurity and compliance provider offering protection for over 8,000 businesses globally. The company’s Threat Protection Platform, which includes Proofpoint Advanced BEC Defense, utilizes their advanced Supernova detection platform to help organizations safeguard their data from targeted attacks and prevent Business Email Compromise (BEC).
The Proofpoint Threat Protection Platform employs machine learning and AI to analyze billions of emails, URLs, and attachments daily. The platform offers advanced features that allow organizations to identify, block, authenticate, and manage suspected threats effectively. Additional benefits include comprehensive BEC threat reporting, supply chain threat analysis, and user-specific data. To enhance user awareness, Proofpoint provides targeted BEC training to help users recognize and report suspicious emails and imposter threats.
Proofpoint’s solution is reliable, easy to set up and manage, as well as being highly effective in detecting and blocking threats. The platform is suitable for organizations of all sizes across various industries seeking a robust email security solution complete with advanced reporting capabilities and user awareness training.
FAQs
Everything You Need To Know About Business Email Compromise (FAQs)
BEC attacks use an authentic and trusted brand to trick victims into sharing sensitive details and information. They rely on accurate and authentic impersonation to make their requests seem more valid. For example, a user will be more likely to share financial details with a brand they already know and trust, than with someone unknown to them.
To make the attacks seem more legitimate, attackers will often try to gain access to an authentic inbox. This means that they are able to send email from a real email address, with the correct header, footer, and DKIM details. This reduces the amount of work they have to do in order to appear legitimate. It is for this reason that it is important for organizations to monitor the emails that are being sent from their inboxes as well as inbound messages.
Malicious actors are able to gain access to inboxes in a variety of ways. This includes using stolen credentials purchased on the dark web, previous phishing or social engineering attacks, and brute force attacks. So, the first thing you should do to prevent BEC attacks is keep your credentials safe. Some of the platforms features on this list are designed for this purpose.
Once they have gained access, an attacker will reach out from the compromised account to existing employees or to other companies. As they are writing from a valid email address, there is very little to raise the victims’ suspicions. The attacker may send a fake invoice, request access to data, or even attempt to hijack another account.
With the amount of information readily available online – think of all the information you share on LinkedIn – coupled with the valid account and ability to look back at previous conversations and imitate style, BEC can be a very effective and dangerous attack type.
To prevent BEC attacks, it is worth keeping an open mind about what to look for. With attackers constantly searching for new ways to trick you, is no checklist (or limit) to how they might try to fool you. Another area that could be worth investing in is Security Awareness Training (SAT) – this educates your users on suspicious behavior and explains best practice responses.
BEC attacks exploit the weakness of emails to target top-level people within an organization. Often BEC starts with a phishing attack which allows cyber-criminals to gain access to an important email account within an organization. For example, someone in the finance department, or the company CFO or CEO. Once attackers have access to this account, they can then send out emails that appear to be legitimate, asking for wire payments to be made from others in the organization, or across their supply chain. These emails won’t be flagged as malicious by any anti-virus or basic email filtering technologies, and most users probably won’t expect their boss or a trusted contact to be compromised, making this a particularly harmful kind of attack.
Another method cyber-criminals can use is simply spoofing the domains of high-level business email accounts. For example, the attacker will see the email address [email protected] and use [email protected] instead. This is known as Lookalike Domain Spoofing. The similarity of the email addresses may be enough to fool suspecting users into believing it’s the real contact that has emailed them, which could convince them to make a payment.
This type of BEC attack is less sophisticated than full account compromise, but it is much more common. It’s also much more likely to be stopped by email security technologies, as they can detect when a domain has been spoofed. However, it can still very successful in convincing unsuspecting users.
Lookalike domain spoofing is commonly used to impersonate brands, such as Microsoft or Apple. Attackers copy these brand domains to try and in convince users to enter passwords, or make payments.
We’ve broadly covered two methods in which attackers can carry out Business Email Compromise attacks, but the FBI has identified 5 unique variants of BEC. Here’s a brief rundown of what each involve:
CEO Fraud: Attackers impersonate a CEO, or a high-level executive, and target employees with requests for payments.
Account Compromise: An employee’s email account is compromised, and attackers use their contacts to request payments to their own accounts.
Bogus Invoice Schemes: Attackers will impersonate suppliers of foreign companies, in order to request fraudulent fund transfers and payments.
Data Theft: Employees in HR and admin departments are compromised so that attackers can gain access to sensitive company and customer information.
Attorney Impersonation: Attackers impersonate lawyers or solicitors to find out confidential business events. This is a sophisticated type of account compromise attack, and much less common.
Most industry analysts agree that BEC attacks are becoming more common because they are low risk for attackers, can be relatively low cost to pull off, and they are often very successful.
Rather than needing to spend time developing malware, or trying to gain access to systems, Business Email Compromise allows cyber criminals to very quickly get access to accounts and send out emails asking for payments. With just one compromised account, cyber criminals can send out hundreds of fraudulent emails, with a pretty good chance that at least one will be opened or replied to.
For high profile targets, cyber criminals may not even need to collect information for account compromise attacks themselves. High level employee email credentials are commonly bought and sold on the dark web. Research from LastLine tells us that CEO, CFO and executive account details fetch a high price, but attackers can make a profit of thousands by successfully mounting a business email compromise scam.
Traditional approaches to email security rely on detecting threats. This could be a malicious domain that’s been known to send out spam emails. Or, it could be an attachment that contains malware, or a URL that leads to a harmful website. Email security technologies can identify threats based on patterns or signatures and stop those emails from being delivered to your users.
However, BEC attacks don’t involve any malware or harmful content being sent. These emails come from legitimate domains and will appear to most email security technologies to be completely innocuous. This means that the email has a high chance of being delivered to your users’ inboxes.
Because they target the human factor within the organization to succeed, once in the email inbox BEC attacks have a good chance at tricking employees into believing they are real. As we’ve covered, BEC attacks often target company executives, like CEOs or CFOs, or employees that work within company finances. When an invoice arrives from an employee like this, people usually trust that it is legitimate, and may go ahead and make the payment without caching the legitimacy of the email.
In addition, attackers are spending more time to develop BEC, spending more time investigating which individuals within an organization are likely to have authority in asking for invoices to be paid.
Considering these factors, it’s no surprise that Business Email Compromise is growing more common and becoming more harmful to organizations. There have been numerous examples of high profile BEC attacks, against organizations of all sizes.
The US Treasury found that the number of business email compromise attacks reported nearly doubled from 2016 to 2018, with nearly 1100 attacks reported every single month. The costs associated also continue to grow, now costing US companies an average of $301 million every single month, according to a Treasury Department Analysis.
When choosing a BEC solution, it’s important to make the right choice for your organization. As no two organizations are identical, it’s important that you take the time to find a solution that matches your needs and addresses your vulnerabilities.
Selecting a solution that doesn’t fit your organization’s profile could leave you with a false sense of security. For instance, your business may release a large quantity of emails and other communications; this could make your brand susceptible to spoofing. Alternatively, you may have a large, disparate work force, the sheer number of employees makes you susceptible to phishing attempts. When selecting a BEC solution, you should consider for the following areas with regard to your own organization:
What Are Your Vulnerabilities?
If you are looking for a solution that can respond to email based threats, it may not be suited to cover SMS or Vishing attacks.
Before deciding what solution is best, look at where you are weakest.
Automation And Configuration
The ability to automate and configure your solution can affect how useful it is to your organization. It may be that you want a solution that you can let run in the background, without any need for input. Equally, you may want a more hands on solution that puts you in control of configuration and management. This decision will be based on your weaknesses, as well as your organizational resource.
What Are Its Features?
When choosing a BEC solution it’s critical to compare the features of each solution to ensure it will work in your environment. URL rewriting, always on connectivity, and database cross-checking gives you the best chance of remediating threats.
As indicated in the previous section, ensuring that your platform has the right features to address the issues that you face is imperative. This can be an overwhelming and confusing area to navigate. Nevertheless, it is one of the most important decisions you face in securing your organization from cyber threats.
- Customization – To ensure that your platform can protect your organization from the unique threats that it faces, your platform should deliver a good deal of customization. This ensures that you can reduce and eliminate any vulnerabilities.
- Domain Authentication – To corroborate if your email messaging is legitimate, you should ensure that your platform delivers DKIM/SPF features.
- Phishing Detection – By identifying and removing phishing mail, you are able to reduce the number of emails that may trick users.
- Employee Training – Good platforms will offer employees training and education to help them identify risk factors and signs of danger.
- Policy Management – Your solution should allow you to create policies and deploy them across all accounts easily.
- User Friendly Interface – Every tool that you use should be straightforward to use and easy to manage, allowing you to make the changes that you need to.
Written By
Alex is an experienced journalist and content editor. He researches, writes, factchecks and edits articles relating to B2B cyber security and technology solutions, working alongside software experts. Alex was awarded a First Class MA (Hons) in English and Scottish Literature by the University of Edinburgh.
Technical Review
Craig MacAlpine is CEO and founder of Expert Insights. Before founding Expert Insights in August 2018, Craig spent 10 years as CEO of EPA cloud, an email security provider acquired by Ziff Davies, formerly J2Global (NASQAQ: ZD) in 2013, which has now been rebranded as VIPRE Email Security. Craig has extensive experience in the email security industry, with 20+ years of experience helping organizations to stay secure with innovative information security and cyber security solutions.