Every email-security layer worked as designed, and the phish still got through
A large benefits-administration company. Outcome verified
The problem
A large benefits-administration company had invested heavily in layered email defenses, yet an obvious credential-phishing email reached an executive's inbox and a user acted on it. Every layer appeared correctly configured, and the vendor would not explain how it had scored the message.
Why it mattered
The lure harvested corporate credentials that attackers then tried to use from suspicious locations. For a platform holding sensitive benefits data on a large population, the next success could be a reportable breach.
What we did
Rather than tune settings blindly, Vizius reviewed the protection consoles with the client's engineers, then reconstructed the message's path header by header. The phish passed because attackers had chained three compromised, legitimate third parties: a bulk-mail account, a domain registrar account and a web server. Nothing was on a blocklist, so reputation-based controls had nothing to act on; the tools had worked as designed.
What changed
The client got a definitive explanation instead of an open-ended hunt for a misconfiguration, plus targeted changes: quarantining first-time senders for high-risk groups, quarantining by geography, MFA and central control of external service accounts, and standing external web-application testing.
- Insurance and benefits
- Large company