The Compromised Account feature is available as part of the standard license plan for partners at no additional cost. Below is a walkthrough on how it works.
Details
- Account compromise detection: when several reported emails trace back to the same internal sender and are also determined to be phishing attacks, CyberNut flags the user account and alerts your admins, catching account takeovers in minutes
- Automatically suspend user accounts as soon as our system detects a potentially compromised account to ensure the account doesn’t have an opportunity
- Auto-quarantine emails across other inboxes with Advanced Threat Search (ATS)to catch all the emails even if they haven’t been reported yet
Q: Is the compromised account flag based on volume of emails sent or volume of recipients?
A: A compromised account detection requires 3 conditions to be true:
- The email has been reported with the CyberNut Reporting Tool.
- The reported email comes from an internal sender.
- The email is scanned by AI-enabled threat manager (technically its ATT) and has a verdict of phishing (score does not matter).
Q: What does the end user see if their account is auto suspended?
A: The end user will not be able to login.
Q: Are there are any wait/lag times when account is deactivated or reinstated?
A: De-activated is instantaneous when score is computed and email is Phishing, re-instated is a manual action from IT admin so latency is not predictable.
Q: Do they get the password reset flow with either reinstate option?
A: At the time of re-instate action we show the new password to IT Admin, they can share with the user.
If an email is compromised it will appear in this area.
Click an email to see more details.
Here you can see details such as score, status, subject, reports, verdict and last reported.
Click the row and more details will appear that you can further investigate.
If an email is compromised you will receive an email similar to this one below if you have entered an email in Settings>Add on to receive CyberNut Alerts.
