Automatic classification of whether a message is potentially a form of BEC attack or not consequently requires AI models that are able to not only identify words but understand the intent. The models must understand generic, underlying patterns which humans are not able to comprehend.

BEC attacks are often very subtle and sometimes provide very little to no clue within the body of the email. Mimecast will not only analyze the message body for sentiment, but also the subject line to determine if there are any risky indicators which may trigger a policy.

Not only will we include the ability for you to set policies based on the confidence level of a detection, but you will also have policy modelling functionality to determine which messages may be caught.

Highlighting the sender is important but being able to leverage our social graphing technology from Cybergraph to be able to provide contextual information on the sender at an individual and organizational level. This provides admins the ability to understand more about who sent the message to understand why it was rejected or held.

Mimecast doesn’t solely rely upon NLP text extraction and a threat model to detect a BEC attack.
· Email DNS authentication failures.
· Domain and user similarity checks using a proprietary algorithm.
· IP address, sender and domain reputation.
· Feeds of known bad IOCs, email content and reputational feeds.
· Credential Theft Protection for suspicious calls to action, correlation of brands between images and sender, web page and certificates.
· Multi-stage phishing detection through phishing signatures.
· IOCs extracted from previously classified emails.
· Abnormal patterns of communication using social graphing technology.
· Rules and heuristics developed by Mimecast Threat Researchers.