Phishing incident response for Security Operations Centres

A new generation of phishing identification and protection, designed and built for security analysts

The old approach to phishing has clearly failed. Organisations continue to commit significant resources to security, yet devastating compromises continue to occur - with the most likely initial vector being phishing. This need not continue.

Up until now, the perception of phishing has been broadly one of irritation, made worse by SOCs not having access to the tools they require to properly address the threat of phishing in a timely and impactful way. However, due to the highly successful and devastating nature of phishing, it must be a priority for SOCs. SOCs need the capability to rapidly triage and identify phishing emails and take definitive actions to prevent their users from being exposed to them in the future.

PhishTool is that capability. PhishTool exists to make the task of responding to user reported phishing as rapid as possible and as detailed as possible, whilst automatically keeping end users engaged beyond the simple act of reporting. PhishTool does this with a blend of automation, guided analysis and built-in expert knowledge, using metadata to reverse engineer phishing emails, revealing context and actionable indicators that would otherwise go undetected.

Phishing emails are a goldmine of valuable threat intelligence, from which the who, what and how of a phishing campaign can be gleaned. This intelligence can then be used to harden an organisation's defences and to hunt in the organisation's environment for potential exposure, protecting them against the most frequently successful method of compromise - phishing.