Today, cybercriminals launched a highly effective email scam that included a link to a Google Docs document that was in fact a link to a 3rd party app designed to steal information from the recipient. Worse, the email appears to come from someone known to the victim. Based on information from the Agari Trust Network, we saw more than 3,016 organizations compromised that sent 23,838 emails to Agari...

In my previous blog post , I introduced the concept of open quarantine. This week, I’d like to explore the two phases of email filtering that make up the open quarantine process. Phase 1 - Tripartite Classification The notion of open quarantine depends on being able to perform a tripartite classification of messages into good , bad and undetermined , where the first two categories have a close to...

In my previous blog post , I provided examples of the growing sophistication – and subsequent success – of several high-visibility email attacks that used social engineering to evade traditional email security filters. This week, I’d like to introduce a new filtering paradigm: open quarantine. Open quarantine balances the needs of security and usability using a two-phase email filtering process...

In my previous blog post, I provided examples of the growing sophistication – and subsequent success – of several high-visibility email attacks. This week, I’d like to look at the different types of emails that are enabling these attacks. Deceptive emails are used by cyberattackers to carry out three different types of attacks: To coerce the recipient to follow a hyperlink to a website...

One of the things that often stumps even the most security conscious companies is knowing all the third-party email service providers they are working with. It is extremely difficult, if not impossible for these organizations to protect their customers from phishing attacks if they don’t even know who is sending legitimate email on their behalf. And this gets even more challenging when you...

Managing AWS costs is confusing, difficult and sometimes can seem downright hopeless. At Agari, we’ve found Cloudhealth to be a useful partner in measuring both AWS usage and spend. As the saying goes: “what you measure, improves!”. In particular, we’ve found it useful to track daily AWS spend. It's helpful both in terms of understanding what drives costs, as well as heading off unexpected...

Agari has made significant investment into infrastructure as code. Almost two years into this project, we’ve learned some lessons. In my previous blog post , I discussed organization of your automation repository and parameterizing environments. For this post, I'd like to talk about state management and database automation. State management One of the most frustrating things about working with...

Agari has made significant investment into infrastructure as code. Almost two years into this project, we've learned some lessons. (If you'd like to read about our first year efforts, check out my previous blog post - Ansible and Terraform at Agari: An Automation Journey.) Our efforts have already yielded dividends by increasing engineering velocity while maintaining infrastructure reliability...

If you have been following our previous posts, Airflow @ Agari and Leveraging AWS to Build a Scalable Data Pipeline or our recent talks on data pipelines and Apache Airflow , you are well aware that Agari leverages both the public AWS cloud and open source technologies, such as Apache Spark and Apache Airflow, to build resilient predictive data pipelines. This summer, we had the pleasure of...

With the surge of phishing and other advanced email attacks, you can’t be too careful when it comes to your inbound email messages. Beyond viewing the basic information provided, you should make it a habit of viewing and understanding your emails' full headers.

In this series of blog posts we examine the most common forms of phishing attacks and appropriate countermeasures to protect both individuals and organizations – in this post we explore hacktivism and the growing range of victims. Politically Motivated & Hacktivism The threat of cyber criminals pursuing a political agenda and seeking to disrupt critical infrastructures has been well documented...

In my blog post last week, Demystifying Machine Learning: Making Informed Security Decisions, I discussed a framework for evaluating Machine Learning claims. This week, let’s see how to apply it. I’ve included below a blurb from the website or data sheet of a fictitious security company called Acme Security. While the company is fictitious, the content is derived from looking at similar material...

At Agari, we think it's important to "walk the walk", not just "talk the talk" so to speak. To us that means implementing the privacy and security measures on our own website and email that our industry talks about every day. This is why we are proud to be recognized once again as a recipient of the Online Trust Alliance (OTA) Honor Roll award and to be designated as "Top of the Class". This is...

We’ve very excited to welcome Norwest Venture Partners to the Agari family! Norwest, the newest investor in Agari, led the Series D funding for $22M we announced earlier this week. Their interest in the Agari Email Trust Platform and its unique ability to stop targeted phishing attacked shouldn’t come as a surprise. They have a long history of investing in the cybersecurity space. Their portfolio...

Ask any security professional what the number one pain point is within their organization, and chances are they’ll say ‘user behavior’…with ‘malware’ coming in as a very close second. And while these issues are very different on the surface, they do have one thing in common: both are often the cause of high-profile data breaches, largely in part to the increased use of spear phishing email...

We’re looking forward to another great FS-ISAC summit next week in Miami. Twice a year, the Financial Services Information Sharing and Analysis Center (FS-ISAC) holds information sharing events, where industry leaders come together to network and share the latest in combating cyber threats and new technology innovation. During the summit next week, Agari will host various on-site activities...

In a recent blog, where we covered why government bodies are prime targets for phishing , we asked whether you’d be able to recognize a spoofed email from a federal agency. The truth is, a spoofed federal email looks very similar to a legitimate email you would expect to receive from government bodies. With the majority of people receiving regular emails from federal agencies, these emails are...

Now that you've (hopefully!) read my first two blog posts on hiring lessons learned, Step 0: Who Are You? and Step 1: The Prep , you're ready to check out my third - and final - post on the topic: Step 2: The How Finding the Candidates If you ask sales managers what qualities they look for in top performers, they will likely include: tirelessly hunting for prospects and keeping their calendars...

As per my previous blog post, hiring software engineers gets more competitive every year. Now that you’ve read the first step in our process, Step 0: Who Are You , here’s the next step: Step 1: The Prep The Pitch Hiring is a lot like sales, and just like a good salesperson, you need a well-honed pitch. For recruiting purposes, you’ll want to break this into two parts: first, the company pitch and...