Step Into The Future of Cybersecurity — Save your spot at the Human Layer Security Summit for free.

Request a Demo of Tessian Today.
Automatically stop data breaches and security threats caused by employees on email. Powered by machine learning, Tessian detects anomalies in real-time, integrating seamlessly with your email environment within minutes and starting protection in a day. Provides you with unparalleled visibility into human security risks to remediate threats and ensure compliance.
Interviews With CISOs
Tessian Spotlight: Don Welch, Chief Information Security Officer at Penn State University
Thursday, July 4th, 2019
Can you give a brief overview of your background and responsibilities at Penn State? As Chief Information Security Officer for Penn State University, I am in charge of a range of things including identity and access management, security operations, privacy and compliance. This involves overseeing the unique responsibilities of each of those teams. What are your core objectives in the role? One of the main objectives I work to, is to understand who is on the network and who has access to what. This is what our privacy and security is all about, stopping people getting access to critical information that they shouldn’t. Compliance is another large objective that has a lot of overlap with security. Compliance is necessary and often the fines and other sanctions are a serious risk to Penn State. However, while the standards do support security initiatives, they’re not sufficient in themselves. That makes the distinction between what policies and programmes are compliance-led versus security-led very important for us. Have you observed any dynamics that are unique to university environments when it comes to information security? The interesting thing for large research universities is that we are affected by almost every area of compliance and information threat that exists. We have healthcare data, valuable research, financial information, student PII as well as a nuclear reactor, an airport and all the utilities cities have. This means we are subject to a range of threats like nation state actors trying to steal IP or gather information for their country, and criminals targeting us for fraudulent payments. Do you think universities are well equipped to deal with these threats? No, it’s a real challenge. Universities do great things as faculties are very entrepreneurial, working on cutting edge innovations with relative autonomy. While autonomy is an important value of the institution, it makes cybersecurity more challenging. The university has so many faculties and operations which create a diverse range of activities within the one system. Creating security alignment that works effectively across the board is therefore a big undertaking. How do you instil a cybersecurity culture in such a diverse environment? We have 17,000 regular staff members and 100,000 students who all fall prey to different kinds of attacks. We tailor our education and training approach to each different group, ensuring that people understand both the threat to them personally and to the institution. How does human error play a role in cyber vulnerabilities? Phishing and social engineering attacks are getting more sophisticated meaning that even very intelligent people can be deceived. We know people make mistakes so it’s important to maintain a combination of approaches to mitigate human error. We implement layered security strategies because you can’t depend on a single defence approach. We build security that considers everything together; people, technology and processes. With a phishing campaign for example, when a normal user has fallen victim and an attacker takes over that account we have several ways of identifying the attack and stopping it before the attacker does damage.  We look for strange account activity that indicates a compromised account.  We mandate protections on privileged accounts, changing the password every time it is used.  We separate our sensitive systems from the rest of the network.  These are some of the controls we use to protect our system in a layered and integrated manner. Where do you see the biggest risks being in future? Attackers are always innovating so we have to continually evolve our defences to keep up. This will become more challenging when adversaries begin to use AI and automated techniques to attack systems much more rapidly. We’ll have to act more quickly to match their speed. But we still have the basic challenges that we need to address – simple attacks still succeed because people continue to fall for spear phishing attacks. We cannot forget about the basics and get distracted by shiny new toys. What are the common misconceptions about the role of cybersecurity? A lot of cybersecurity professionals look at security from a risk-based approach, they’ll assess what the individual risks to the organization are. That’s important, but it has to be incorporated into a larger strategy that looks at the bigger picture of potential damage and allocates our cybersecurity resources in an efficient and effective way. We have to think how our attackers are thinking in order to understand how they will attack us.  
Read Blog Post
Interviews With CISOs
Tessian Spotlight: Graham Thomson, CISO at Irwin Mitchell
Thursday, July 4th, 2019
Tessian spoke to Graham Thomson, CISO at leading law firm Irwin Mitchell, about his career and why he uses Tessian to keep Irwin Mitchell’s employees safe on email. To get started, can you take us through how you first got into security? I got my degree in genetics and then worked in military intelligence, where I received a grounding in computer security. After a few years, I left the military and got a job as an investigator for a global retailer. Initially this was to investigate fraud and corruption, but evolved to cover issues relating to information security, such as insider breaches and hacking. Having decided that a career in information security was for me, I then obtained my CISSP qualification. I’ve since been lucky to experience many different industries, including insurance, online banking and e-commerce, and now the legal sector. I’ve been focused on purely information security for around 12 years now. How has the industry changed since you began your career, and what has the impact of technology on security been? Information security has changed hugely over time, probably because the threats themselves have changed. When I started out, I think it’s fair to say the work we were doing probably wasn’t that well understood. When I was being trained initially, I remember learning about a KGB-initiated infiltration of systems that was discovered pretty much by chance: this was a real eye-opener that brought home just how important computer security was going to be in the modern economy. One of the biggest changes is the focus on people. Previously, security professionals would be technical IT specialists, but today many different career paths – the military and law enforcement are just a couple of examples – can lead towards information security. The ability to understand an issue from the attacker’s point of view is very useful. You can spend as much money as you want on technology, but at the end of the day there are humans with legitimate access to your systems; if they are negligent or abuse their positions, then there’s very little that tech can do to stop that. What are your core responsibilities at Irwin Mitchell? And what are your ambitions for your department and the team over the coming years? My core responsibility is setting the strategic security vision for the company and making sure we successfully deliver on our objectives. I refer back to this regularly to work out whether there are gaps in our present strategic framework, or whether we need to readjust priorities on particular technical projects. It’s all well and good sitting and thinking about high-level problems, but real-world feedback really helps to crystallize the impact of what we’re doing. It’s my security policy, but I want to know how it translates across the business. The key thing is that many people within law firms deal with very sensitive personal and company data. Our bread and butter is keeping this safe. Firms in other sectors may only have a few people dealing with sensitive data, but in law firms the proportion of people in the business who have this responsibility is far higher. This information isn’t just internal, it comes from external parties too. For example, we might have sensitive medical records or information relating to military matters as part of the work our solicitors do. The legal space is a fairly unusual sector in that we have to think about security in a very broad sense. The very term ‘cybersecurity’ reflects the fact that more and more of the information people consume is digital. But working at a law firm, there are paper records that have to be dealt with too. So my role depends on understanding and managing all the implications of information security, not just the technical aspects. It’s important to remember that our people could be very experienced lawyers or new graduates: we have to make sure that everyone understands what their security responsibilities are. People have to know how to handle information from when it comes into our orbit right through to when we dispose of it. Security can’t just be a case of asking people to read a lengthy, technical policy document. I have to ensure the information is relayed in a way that’s meaningful, interesting and relevant, and I need to make sure the technical tools we use are easy to understand. How can new security technology help the legal sector really make strides in the years to come? The first thing to say is that the legal sector has probably not moved as fast as some other sectors when it comes to adopting technological solutions. Although there are some startups making strides in ‘legal tech’, fintech, for instance, has a higher profile and potentially more innovation happening in that space right now. Things are improving, but the sector has a whole has possibly been slightly behind the times. For me, where the sector could really benefit is access to justice: I think tech will help ordinary people engage more meaningfully with the legal system. Law is complex, and there are so many gray areas, but I’m hopeful that developments in artificial intelligence (AI) hold a lot of promise. It’s never a good thing when someone decides not to approach a lawyer or a law firm because they’re not sure whether it’s worth it or because they think the process will be particularly laborious. Tech that allows people to ask initial questions without having to directly engage the services of a human lawyer could mean that people find it less intimidating to approach law firms. I think we’re now moving past the point where people expect to have to walk into a physical office to have meaningful conversation with a legal professional. You could easily get the same result from your own home, or on your phone, and that kind of relationship is what we need to be thinking about. I also think there could be major benefits to research. When paralegals need to sift through thousands of pages, AI could help surface the relevant information more quickly. Bots that do more labor-intensive work like reviewing long contracts could also save significant chunks of time. Next-generation technologies like AI could definitely help the legal sector move forward. The danger with AI though is that biases may still come into play, as is often the case when dealing with complex algorithms. Can you tell us about your experience bringing new technologies into a law firm? I’m fortunate that today, cybersecurity is taken very seriously at board level. If I can show that there’s a requirement and a potential benefit with a new piece of technology, the appetite to mitigate that risk is usually there. When it comes to end users, we have to think carefully about altering processes they might be used to, or telling them to stop doing something that seems innocuous. I’ve found that as long as the training and awareness is communicated well, it’s usually accepted without too many hiccups. Interestingly, when we implemented Tessian Guardian, which helps us combat misdirected emails within the organization, it was one of the few security products where we had no complaints about it. In fact, people sent us screenshots thanking us for preventing emails potentially going to the wrong destination! It’s great for the team to feel like we’re making positive changes within the organization. Could you describe Irwin Mitchell’s attitude to information security in a couple of sentences? Our people see information security as an absolute necessity when it comes to doing business. Everyone acknowledges that they share responsibility for the firm’s success or failure here. So how important is Tessian to your overall security stack? Tessian is critical for us. Misdirecting an email is very easily done: people want to be productive, and they don’t always notice when autocomplete gives them an incorrect email address. Tessian also gives us great analytics and reports which help us actually analyze the data, over and above the solution itself. We’re soon going to be implementing Tessian Defender, which will help us address inbound spear phishing threats and make Irwin Mitchell’s security structure even more secure. Tessian is just a very clear way for us to communicate potential risks and give our colleagues additional protection. *Interview condensed from Modern Law Magazine supplement, May 2019.
Read Blog Post
Interviews With CISOs
Tessian Spotlight: Sarat Muddu, IT Security Director at Kelley Drye
Thursday, July 4th, 2019
Kelley Drye & Warren’s IT Security Director Sarat Muddu talks about the process of implementing change, and how his firm wards off threats by embracing innovation. As an IT professional, what attracted you to a career in the legal sector? I’ve had experience in a wide variety of sectors, but I was fascinated by the security challenges of the legal space. Although I wasn’t a legal expert when I joined Kelley Drye, I moved across from health care, which is another industry that is extremely sensitive to cybersecurity risks, so I understood the importance of the problem. How important is it that the top level of a firm is alert to the dangers of cybersecurity? Even at board level, there should be people who understand the more nuanced technical details of a security project. At Kelley Drye we’ve been lucky to get great buy-in from our managing partner and CIO. They see a direct connection between a well-constructed security policy and the broader success of the business. I can’t speak for other law firms, but ever since I’ve been working in the legal sector, I’ve seen significant positive movement in how people approach and value security. This is one really refreshing change. We regularly get inquiries from partners asking whether we are protecting ourselves against this or that new threat – they pay attention and want to ensure firm and client safety. If we can continue developing this kind of curious mindset, I’ll be happy. It’s important to remember that a main driver of this new focus comes from partners being keenly aware of potential damage to a firm’s reputation. You don’t want to be the firm in the headlines because of a security breach, and you have to preserve client relationships, which are the bedrock of any firm. Why is email a particularly high-risk activity at law firms? I think all industries are susceptible to engaging in risky behaviors, but the kinds of data held in law firms means any unauthorized email that goes to a personal address is potentially more dangerous because of the content of that email. We all want to take the convenient path, but it’s the responsibility of a security team to manage and, if necessary, plug holes in those workflows that increase risk. Email is one of the most heavily used tools in any law firm, alongside document management systems. Human error is always one of the big factors in any data breach report. Lawyers send and receive a lot of email, so in a sense it’s natural that they may be more likely to misdirect an email, for instance. Even IT teams are not immune to these pressures! Is it the case that email is just an inherently risky mode of communication? At Kelley Drye, our ‘Defense in Depth’ strategy tackles security concerns at every layer of the stack, from our perimeter down to individual devices, and people too. As a security team, we have established a number of risk management and training programs to help us avoid any sleepless nights. Email security is a critically important part of this mix. As technologists, we have to make sure that all our communications channels allow business to function without any hindrance. If people don’t have a seamless experience in an enterprise, that actually raises the likelihood of people trying to evade those systems by, for instance, sending an email to their personal address so they can work on something at home. They’re not trying to be malicious, but they are putting data at risk. That’s why when we’re thinking about bringing in a new security tool, we take into account not only how robust the product is but how it impacts the team’s work. Ease of use is incredibly important to us, and that’s actually what Tessian does very well. How does Tessian make it easier for you to learn about and act on potentially risky behaviors? It was really important to us that Tessian would improve our knowledge as a security team. The market for security products is incredibly saturated, and not every product is able to offer a rich level of detail to its administrators. Not only did Tessian give us valuable historical analysis, working retroactively, it was very easy to start using it. Out of all the security products we’ve invested in, Tessian has had the lowest amount of up-front work to do to get set up. This meant we could get started analyzing the results straight away. We are now able to have a better dialogue with legal professionals and other end users, because rather than just being blocked from doing certain things, people know why an action could be problematic thanks to the insights Tessian displays within the email client. So do tech products like Tessian help you drive cultural change within the firm? Implementing change is only easy when it’s a team effort. When I’m making a business case for why a tool will help the firm, having productive discussions around the business – not just with the management team – is paramount. You can’t drive real cultural change with just a couple of people: it doesn’t happen overnight. In general, when we’re implementing a new piece of technology, the fewer complaints we get the better, and we haven’t had a single complaint or unhappy query about Tessian. In the long run, this makes it easier for me to bring the next security project to the board and justify investment, which makes my job easier. Finally, looking a few years ahead, where would you like to see the legal sector progress? I think the legal sector is in a really interesting period as far as technology is concerned. Every time I go to a conference there are new and innovative solutions targeted at helping law firms succeed. At the same time, the business of law firms is changing. We have to evolve at the same pace as other industries, moving with the times. We’re seeing big shifts towards agile and remote working, for instance. How are legal security teams going to deal with this new dynamic, securing client data while giving professionals more flexible ways to get work done?  For us, investments in products like Tessian are a great example of how much the firm values technological innovation. *Interview condensed from Modern Law Magazine supplement, May 2019.
Read Blog Post
Interviews With CISOs
Tessian Spotlight: Duncan Eadie, IT Director at Charles Russell Speechlys
Thursday, July 4th, 2019
Duncan Eadie, IT Director at Charles Russell Speechlys, speaks about the risks law firms face from cyberattacks, and the importance of embracing technological innovation. What were some of the main threats in cybersecurity when you first moved into the sector? The first computer virus I was aware of was distributed in 1988, and in my first job we had a lunchtime session discussing it! We then had to contend with viruses distributed via floppy disk, which demonstrates just how far the industry has come. At that time, people breaking into computer systems was almost done for fun; now, cyber crime is a major global industry in its own right. Lawyers and clients alike are now all aware of the consequences of handling data inappropriately. Today, we expect security from every organisation we deal with, not only as professionals but also in our personal lives. Does security permeate all aspects of your role, or is it effectively treated almost as its own business unit? My role is essentially to design and deliver Charles Russell Speechlys’ IT strategy. That means overseeing the development of products and services, and then successfully introducing these across the business. Within the IT department, I’d say that security has had to become more of a specialist requirement in recent years, partly because criminals and tactics are becoming more sophisticated. This vertical knowledge has to be supported by core tools that help us do this more specialized work. What are some of the challenges around driving change in a business like Charles Russell Speechlys? In some ways it depends on the change you’re introducing. When we introduce products like Tessian, which doesn’t necessitate huge change to working practices and which doesn’t require lots of training, you can feel people embracing the change in a different way. From a people perspective, the principal security challenge is really to make sure that everyone around the organization is vigilant, whether you’re a lawyer, a secretary, a software engineer or a marketing professional. In a broader sense, the entire legal industry is feeling that there’s a significant shift happening right now. This isn’t at the individual or firm level, it’s impacting the whole sector. Firms have to decide at what point they want to catch that wave of change. For forward-thinking law firms, this is a fantastic opportunity to build on the heritage of the past and embrace the opportunities of the future, something that’s in the DNA of Charles Russell Speechlys. So why is this technological shift happening now, and what are the knock-on effects for security? I think there is some frustration on the part of clients that the legal sector isn’t changing and evolving at the same speed as other industries. Changing customer demographics are beginning to disrupt the legal market in the same way as many other industries. In general, customers are more willing to challenge the professions and really engage with their service providers, and that means law firms need to offer a modern experience for clients. Regulatory changes are also impacting these strategic decisions. We’re now seeing more punitive penalties for breaches of regulation, and that affects the way firms might think about the risks of expanding into a new practice area, for instance. All of this has consequences for security. What do you wish the average lawyer knew about cybersecurity? That if their cybersecurity knowledge is not up to scratch, their firm’s reputation could be damaged very quickly. We’re talking about a relatively small investment in time to focus on cybersecurity best practices. In the long run, this could protect a reputation which has been built up over decades. It only takes a moment to potentially destroy all that. And what would you say to a technologist or security professional thinking about a career in the legal sector? What advice do you have that would help them make an impact? Too often in the industry, making something more ‘secure’ results in making it harder to interact with. Technologists coming into the sector should empathise with legal professionals and realise that people don’t want barriers, however difficult that might be to incorporate into products. If people build products that combine security with ease of use, you’re onto a winner, and that’s actually what Tessian has done. The other thing for IT specialists to remember is that much of a law firm’s business still stems from its reputation. Reputation can be a very fragile entity, but it’s also why law firms will survive over the long term. Protecting reputation is absolutely key. So much important work carried out by lawyers is based on their firm’s and their own reputation. When people or businesses are in extremely sensitive situations, facing very difficult decisions, they don’t want an app, they want to talk to someone whose advice they trust. In this environment, our duty is to preserve and enable this intimate communication as best as we can with the support of technology, while balancing this need with best-in-class security practices. How is Tessian helping Charles Russell Speechlys tackle threats and manage email security? Well, the channel that generates the highest number of complaints to the ICO every year is email. Firms can easily send hundreds of thousands of emails every month: when businesses have that volume of communication, you don’t have to be wrong very often for it to really matter. Misdirecting an email isn’t something someone does intentionally, and I’m sure that your readers have all experienced sending an email to the wrong person at some point. With Tessian, we don’t encounter pushback from within the organisation, so it’s a great way to deliver meaningful change in the firm. Tessian proves that modern technology can support our lawyers and help protect their relationships with clients. *Interview condensed from Modern Law Magazine supplement, May 2019.
Read Blog Post
Engineering Team
Introducing Catapult: Tessian’s Very Own Release Tool
Sunday, June 30th, 2019
Today we’re excited to open source our internal release tool – Catapult. At Tessian we run our CI/CD pipelines from Concourse. (Like many, we picked Concourse because it’s not Jenkins*, but we’ll save that for another blog post). Although Concourse is a fantastic build tool that cures a lot of headaches for us, as the creators will readily admit, it is not necessarily a tool with the most advanced security setup. As a company that deals with some of the world’s most sensitive data, this was not good enough for us. We wanted a release tool with security features like two-factor authentication and an audit trail that we had come to expect from other tools we use day to day. At Tessian we also empower our development teams to release and maintain their own services, so we wanted a system that allowed for permissioning. After some head scratching, it became apparent that we didn’t need to reinvent the wheel. By driving our releases from files stored in S3 and making use of Concourse resources, we could meet all of our requirements and more. This was our list of demands: • Fine-grained permissioning • An extensive audit trail • Flexibility • Two-factor Authentication • High Speed & High Availability • Usability So what exactly is Catapult? Catapult is two things: • a command line tool that manages state in S3 • a Concourse Resource, that consumes said S3 bucket The permissioning is all managed on the AWS side and left as an exercise to the reader. Command line The catapult command showing a new release In the background this is doing a number of checks. It’s looking at S3, git and our docker repository. Assuming they have the correct permissions, this will update a file in S3, which our Catapult Concourse Resource is monitoring. Concourse resource When the resource discovers a new version of the file, it will download it; create a new version of the Concourse resource; display all the above metadata; and – assuming it is set up to do so – trigger a new task. From here you can do whatever you want with the version managed in Concourse. What next? We think there’s plenty of work left to do on Catapult but wanted to share what we’ve built thus far with the world. We’re very keen to hear feedback, please send us a pull request or issue on Github! *We think TheNewStack give a nice summary of some issues we’ve had with Jenkins in past lives: https://thenewstack.io/many-problems-jenkins-continuous-delivery/       #engineering
Read Blog Post
Human Layer Security
Why Wednesday is Your Business’ Riskiest Day
Monday, June 24th, 2019
They call it the Hump Day for a reason; our latest research has revealed that workers feel the most tired on Wednesday afternoon and this could be putting your data and systems at risk. This is because when we are tired, we become more error-prone. In fact over three quarters of people (76%) we surveyed say that they make more mistakes when they are feeling sleepy. The problem is that is just takes one mistake – one email accidentally going to the wrong person or one click on a phishing scam – to compromise sensitive data and ruin a company’s reputation. No rest for the wicked Phishing is becoming a persistent hazard for businesses to deal with. The number of phishing attacks continue to rise year on year and today, around 6.4 billion fake emails are sent worldwide every day. Furthermore, Verizon revealed that a staggering 94% of malware is now delivered by email. Therefore, it’s never been more important for employees to spot the good from the bad to avoid falling for the scams. But given that 91% of UK workers told us they feel tired during the working week, with one in five feeling tired every day, can we really expect employees to make the right decision 100% of the time when faced with a cybersecurity threat on email? The thing is, when we are tired and stressed, we may overlook cues present in a cyber threat. This is according to cyber-psychologists Dr Helen Jones and Prof. John Towse who recently shared their insight in our latest report – Why Do People Make Mistakes. Tiredness affects our ability to question the legitimacy of messages and makes us more likely to miss something that signals a threat, simply because we have less cognitive capacity available to dedicate to evaluating new information. Tired employees also pose another risk; fatigue makes it harder for people to resist the impulsive urge to respond to a persuasive request in a potentially malicious email. A study by Washington State University, for example, found that sleep deprivation not only increases the likelihood of someone making risky decisions but also decreases a person’s awareness about why they were taking risks. With email being so quick and easy to use, tired employees may not even register the risk their inbox could pose. What’s more, it’s not hard to imagine that a smart hacker could even start to target your most tired employees at certain times of the day in a bid to trick them to click. Waking up to the threat We cannot expect people to make the right cybersecurity decisions 100% of the time; tiredness and overwhelming workloads lead to risky decisions on email and this poses a threat to your business. Rather than seeing employees as the first line of defence, you instead need to consider how to use technology to limit the number of costly mistakes that are just waiting to happen. By alerting employees to potential threats and advising them on the action to take, you can mitigate the risk and encourage people to think before they hit ‘send’ – especially during that Wednesday afternoon slump.
Read Blog Post
Tessian Culture
#TransformTheFuture: Celebrating International Women in Engineering Day
Friday, June 21st, 2019
On 23rd June 2019, we are celebrating the outstanding achievements of women engineers across the world as the sixth International Women In Engineering Day takes place. This year the theme is all about transforming the future so we’ve asked some of our engineers what they think the future holds for engineering and how we can get more girls into this exciting industry. Monika Pawluczuk, Developer Why do you love being an engineer? I get to create and be innovative. I can join a passion with work, and it feels like I’m doing something meaningful. How do we encourage more women to get into engineering? I think that we need more role models. There are so many strong women in tech that we can look up to from Ada Lovelace and Margaret Hamilton, to more modern examples like Parisa Tabriz, Radia Perlman, Allison Randal or Lyndsey Scott – yes, a Victoria’s Secret model that is also a programmer! I think the best motivation is seeing successful women in tech that we can strive to become one day. What do you think / hope the future of engineering looks like? I hope it becomes an environment that everyone can thrive in. Curiosity, courage and innovation are at the heart of engineering. I hope that, in the future, children’s education will change and kids will be introduced to creating games and robots much earlier on. I wish I could have Lego Mindstorms or Kano PC when I was growing up! Andy Smith, Head of Engineering What’s the best bit about being an engineer? Having to solve hard problems that you don’t know the answer to. It’s daunting at first but it’s hugely satisfying when your solution works. You may soon learn that it wasn’t quite as simple as you thought, but the learning experience of having your understanding of the problem evolve is rewarding. Why is diversity important in engineering? It’s just smart to aim for a diverse engineering team. If you find yourself trying to make an important decision with a group of people similar to yourself – it’s not uncommon to find that you all agree. A group of engineers all agreeing is generally something to be concerned about. We need different people to bring different ideas, and the only way to make great decisions is to have a broad range of input. We have the best outcomes when we disagree and debate. What do you hope the future of engineering looks like? Diverse. Cassie Quek, Data Scientist What’s the best bit about being an engineer? The best bit for me is being able to help build the tools of tomorrow that make a positive impact in the lives of others. How do we encourage more women to get into engineering? I think, as female engineers, we can be more vocal about our experiences. We need to show that there is an active community of women in engineering roles and that a lot of the obstacles we think would arise from working in a traditionally male-dominated environment are imagined. It’s also important to know that there will be plenty of support. What do you hope the future of engineering looks like? I would love to see the tech engineering scene become even more diverse in all regards – maybe one day eroding even the existence of any cultural stereotype. Ed Bishop, Chief Technology Officer Why is diversity important in engineering? The problems we are solving are diverse, so to build the best product and have the greatest impact, we need to have an engineering team that reflects that diversity. Otherwise you don’t have the right ideas, opinions and empathy at the table and your product will suffer as a result. What do you hope the future of engineering looks like? I hope that engineering teams of the future will also be diverse in seniority levels. Diversity needs to be reflected in junior hires all the way through to executives. That’s when teams, and products, will truly benefit from having all voices represented. Sabrina Castiglione, Chief Financial Officer and Chair of the WISE Young Professionals’ Board Why is engineering an exciting industry to be part of? A lot of engineering is about being creative and solving real problems that impact people’s lives – and even saving lives! From working on the systems that land people on space stations to writing the algorithms behind the software that is transforming our daily lives, engineers are working collaboratively and making a huge difference to what the future of the world will look like. How do we encourage more women to get into involved? I think a lot of the stereotypes about engineering don’t reflect the reality of what a vibrant, exciting, and impactful careers engineering can lead to. That needs to change. We also need to set positive examples for the next generation. As part of my work with WISE, I’ve been helping with a Harper Collins collaboration on the Tara Binns book series – including Tara Binns: Big Idea Engineer – to show Key Stage 2 girls that careers like engineering are for people like them. Johan Kestenare, Data Scientist Why is diversity important in engineering? Diversity is important in engineering, as in life. Both talent and innovation are not owned by one gender, and being able to share ideas with women as well as people from different cultures allows me and my team to develop our professional and personal skills. Some of best products and concepts are created by a team built on diversity. What do you think the future of engineering looks like? In the future, I hope we that won’t have to ask that question again simply because diversity in engineering wouldn’t be questioned. Diversity would have become the “norm.”     #engineering
Read Blog Post
Human Layer Security
Tired and Overworked Employees Pose a Huge Risk to Business’ Data
Wednesday, June 12th, 2019
New Tessian report reveals that working environments stop people making safe cybersecurity decisions at work. Today’s working environments are making it impossible for employees to make the right decision 100% of the time when faced with a potential cyber threat on email, reveals a new report from cybersecurity company Tessian. The report – Why Do People Make Mistakes? – presents findings from a new survey, conducted by Tessian, in which 1,000 UK employees were asked about their working environment and practices. Additionally, the report includes insights from cyber-psychologists Dr Helen Jones, University of Central Lancashire and Professor John Towse, Lancaster University, which further explains how certain factors in the workplace can cause people to make suboptimal decisions, leading to dangerous behaviour on email. The research reveals how overwhelming workloads, office distractions, fatigue and stress affect a person’s cognitive capacity, potentially impairing an employee’s ability to identify signs of a potential cyber threat – such as a phishing scam or sending an email to the wrong address. This, Tessian argues, puts businesses’ data and systems at risk given that 52% of UK employees say they’ve accidentally sent a work email to the wrong person. Tim Sadler, CEO at Tessian said, “Every time someone sends or receives an email, they are making a decision. When you consider how much time we spend on email, it’s little wonder that sometimes those decisions result in mistakes. However, it takes just one mistake – one email being sent to the wrong person or falling for one convincing message – to compromise your company’s data and ruin its reputation. Businesses, therefore, need to consider how they can protect their employees on email.” The factors that affect people’s ability to make the right cybersecurity decisions at work include: 1. Quick-to-click cultures Over half of UK employees (58%) say there is an expectation within their organisation to respond to emails quickly. Dependency on mobile phones isn’t helping the situation; nearly six in ten (59%) respondents say they use their mobile phones to send work emails out of office hours, with nearly a third doing so at least 2-3 times a week. Two in five respondents (39%) admit they respond to emails much more quickly on their phones. Dr Helen Jones said, “Studies have repeatedly shown that time pressures significantly impact decision accuracy. Under pressure, we are more likely to rely on impulsive, low-effort behavioural responses and dedicate less attention to the situation in front of us. What’s more, an increased pressure upon employees to be constantly connected on-the-go means there is a higher likelihood of distraction and, therefore, mistakes.” 2. Tired and stressed The majority of UK employees (92%) feel tired at work, with people feeling most tired on Wednesday afternoons. In addition, 91% say they feel stressed at work, with people feeling stressed, on average, half of the working week (2.4 days). Worryingly, over three quarters of respondents (76%) say they make more mistakes when they are tired, while 71% say they make more mistakes when stressed. “Tired and stressed employees pose a real risk to email security,” explains Jones. “When we are tired and stressed, we are less likely to question the legitimacy of messages and miss the cues that signal a threat. We are also much more impulsive when we are tired, making it harder to resist the urge to respond to a tempting or persuasive request in a phishing email.” 3. Information overload More than two in five UK employees (44%) describe their current workload as either ‘overwhelming’ or ‘heavy’. On top of a never-ending to-do list, employees are faced with many distractions, including: 1. Office noise (37%) 2. Colleagues ‘dropping by’ (34%) 3. Email notifications (30%) 4. Meetings (26%) 5. Notifications on their personal phones (20%) When juggling multiple tasks at once, employees will likely rely more on habitual behaviours rather than engaging in analytical thinking. This makes businesses more vulnerable to threats over email given that a person’s ability to focus is impaired. 4. Trickery and trust Hackers are becoming smarter in their approaches to phishing, often impersonating well-known brands or senior executives within an organisation. One in 10 respondents admitted to clicking on a phishing email at work. This figure was much higher in the financial services industry where nearly one in three (29%) respondents in this sector admitted to clicking on a phishing email. Sadler concludes, “Businesses cannot rely on employees being the first line of defence. Mistakes happen, especially when people are tired, stressed and overworked. Companies need to help people make conscious and safe cybersecurity decisions on email, putting a safety net in place to prevent the inevitable. Only then, can businesses protect their data and systems from human failure on email.”
Read Blog Post
Customer Stories
Mitigating Inbound and Outbound Email Threats
Wednesday, June 12th, 2019
Evercore is one of the world’s leading independent investment banking firms. Headquartered in New York City, and with over 2,000 employees and offices across major global financial centers, Evercore serves a global base of clients on a variety of highprofile transactions. These include M&A, strategic shareholder advisory, restructurings, capital raises, equity research, sales, trading, wealth management and trust services. Since its founding in 1995, Evercore has advised on over $3 trillion in M&A, recapitalization, and restructuring transactions. Evercore is protecting over 2,000 people with Tessian Defender, Tessian Guardian, Tessian Enforcer and Tessian Constructor.
Moving past manual solutions Evercore is a firm with exceptionally high standards. That extends to deploying new pieces of software. In heavily transactional environments like investment banking, any downtime or performance issues caused by a new software product is potentially damaging. IT teams often cite ease of deployment as a main priority for new software. Chris Turek, Evercore’s Chief Information Officer, understands just how important it is to deploy new systems quickly and smoothly.
Incredibly simple, uniquely effective For Chris, the beauty of the Tessian platform lay in its administrative simplicity. When Tessian is installed on an email network, it begins analyzing historic email communications retroactively to learn what constitutes ‘normal’ behavior for each user. Within hours, Tessian was up and running, protecting Chris and Evercore’s employees against misdirected emails due to human error. Tessian has also been instrumental in targeting spear phishing emails generated outside the organization. What’s more, Tessian’s platform doesn’t require large sets of pre-labeled data or complex integration processes. The add-in can be installed by simply downloading a file, and it can be rolled out to users at the IT team’s discretion. As Tessian integrates directly with Microsoft Outlook, Office365 and G Suite, all major enterprise email environments are catered for. Learn more about how Tessian prevents human error on email Tessian is building the world’s first Human Layer Security platform to automatically secure all human-digital interactions within the enterprise. Today, our filters use stateful machine learning to protect people using email and to prevent threats like spear phishing, accidental data loss, data exfiltration and other non-compliant email activity. To book a demo and learn more about how we can help your organization, click here.
Evercore Case Study hbspt.cta.load(1670277, '64b7cdd7-d73a-4573-88ec-56e7cee61f20', {"region":"na1"});
Read Blog Post
Customer Stories
Data Loss Prevention in Healthcare: A Serious Business
Tuesday, June 11th, 2019
Laya Healthcare members have access to some of the most innovative health insurance benefits and services in the Irish health insurance market. Working with over half a million customers, its brand promise, Looking After You Always, represents laya healthcare’s member-centric approach, which is fundamental to its vision and values. Part of global insurer AIG since 2015, Laya healthcare also offers life and travel insurance policies. Laya Healthcare is protecting 550 employees with Tessian Guardian.
Security in healthcare: a serious business Health insurance is an intensely specialized industry and can be fragmented from a technology perspective. Significant amounts of information are constantly transferred between different practitioners, hospitals, other insurers and partner organizations. As one of Ireland’s largest health providers, Laya healthcare deals with extremely sensitive information. Ian Brennan, Director of IT at laya healthcare, and his team go above and beyond to ensure human error doesn’t contribute to breaches or put individuals’ data at risk. Ian is responsible for overseeing Laya healthcare’s security and privacy. Analysing their security data, he established that particular email productivity functions like Autocomplete were actually contributing to errors being made by people. As Ian says, “We always want to save our team time, but unfortunately there are negative consequences to these efficiency-led features too.” Ian needed to find a way to eradicate the possibility of these errors without disrupting employees’ productivity on email.
Minimizing disruption for the workforce Laya healthcare’s existing Data Loss Prevention tool was catching most mistakes being made by people on email. However, certain limitations meant that Ian was looking for a more intelligent solution that learned from users’ behaviour, and which required minimal time investment from the IT department. In Ian’s experience, “there are a million tools that say they’ll do exactly what I need. But if I need a performant product that runs unobtrusively when it’s not doing its job, there aren’t many solutions that really fit the bill. Ian is sensitive to the knock-on effects on his IT team when software doesn’t work as intended. Since Tessian deployed the Guardian product for Laya healthcare, it has needed minimal “care and feeding”, as Ian says, requiring no IT input to make sure Guardian was learning as expected. This freed his team up to tackle higher-value work. “I’ve seen very few products as light on IT admin as Tessian.”
Moving beyond rule-based systems Ian was eager to take advantage of Tessian’s ability to learn from employees’ behaviours, identifying which email conversations were ‘business as usual’ and which emails needed flagging. Ian is confident that leveraging Tessian’s machine learning will reduce overhead for his team and the wider business in the coming years. “As rule-based systems expand in complexity, the maintenance and service requirements often increase too. We anticipate that Tessian will scale much more smoothly.” Insurance companies are confronting a changing security climate. “People are now much more switched on to their rights as individuals, and security risks are always evolving too.” Tessian and laya healthcare will continue to work closely together in the coming months and years, helping eradicate human errors on email and helping laya healthcare members get the topclass service they deserve. Learn more about how Tessian prevents human error on email Tessian is building the world’s first Human Layer Security platform to automatically secure all human-digital interactions within the enterprise. Today, our filters use stateful machine learning to protect people using email and to prevent threats like spear phishing, accidental data loss, data exfiltration and other non-compliant email activity. To book a demo and learn more about how we can help your organization, click here.
Laya Healthcare Case Study hbspt.cta.load(1670277, '6a36d064-618a-46aa-a821-1c527caf151a', {"region":"na1"});
Read Blog Post
Customer Stories
Tackling Spear Phishing when the Stakes are High
Tuesday, June 11th, 2019
Polarcus is the world leader in offshore geophysical services. Its fleet of green, hightech vessels conduct explorations from pole to pole, producing seismic survey data for global clients. Headquartered in Dubai, the company is listed on the Oslo stock exchange. Polarcus is protecting 350 employees with Tessian Defender. 
The spear phishing paradox Spear phishing is a relatively new and very different kind of security threat. For decades, spam and bulk phishing attacks have relied on unsophisticated mass messaging, effectively hoping that one or two people out of thousands don’t pay attention and make elementary mistakes. Spear phishing, by contrast, is far more malicious. Inbound emails targeting specific people, using social pressures to imply urgency, are a much more challenging threat for legacy security products. Erik Ruis joined Polarcus as Head of IT in early 2019. At that point the company was working out how to address sophisticated threats that could bypass its existing security infrastructure. He comments, “Threats like data theft and systems takeover can start from a single spear phishing email. Making things more complicated, companies in our sector have become targets for attackers seeking financial gain or trying to make an environmental or political statement.” This set of circumstances led Polarcus to Tessian.
Helping users make better judgments Spear phishing techniques like domain impersonation (when an attacker changes, for example, ‘tessian.com’ to ‘tesssian.co’ in order to trick a user into thinking an email is coming from a colleague) pose enormous risks to organizations. To effectively combat these threats, busy email users needed to understand in real time why an email might be suspicious. Defender, Tessian’s product built to combat spear phishing threats, was the natural solution. In Erik’s experience, “When you show someone a phishing email and tell them it’s an impersonation, they are still sometimes unable to understand why it’s fake.” This underscored the benefits of a product that leverages machine learning to automatically provide contextualised warning messages to users, a fundamental part of the Tessian offering. Now, Erik says, “we don’t get many alerts from Tessian, but when they happen people definitely notice them and benefit from them.”
What the future holds As Polarcus continues to innovate, Erik will keep looking for intelligent products that can tackle issues to do with human behavior on email, such as data exfiltration. The key will be identifying solutions that focus on “patterns of behavior, rather than rules.” In the meantime, attackers trying to circumvent legacy rule-based systems means that for Erik, “as perpetrators become more creative and more sophisticated over time, I expect Tessian’s products to keep adding even more value.” Learn more about how Tessian prevents human error on email Tessian is building the world’s first Human Layer Security platform to automatically secure all human-digital interactions within the enterprise. Today, our filters use stateful machine learning to protect people using email and to prevent threats like spear phishing, accidental data loss, data exfiltration and other non-compliant email activity. To book a demo and learn more about how we can help your organization, click here.
Polarcus Case Study hbspt.cta.load(1670277, 'bc5ef259-cd9e-4061-b40d-e49fdae495b3', {"region":"na1"});
Read Blog Post
Customer Stories
Focusing on Security Basics with Game Changing Technology
Tuesday, June 11th, 2019
Arm technology is at the heart of a computing and connectivity revolution that is transforming the way people live and businesses operate. Together with 1,000+ technology partners, Arm is at the forefront of designing, securing and managing all areas of computing, from the chip to the cloud. Arm is protecting 6,000 employees with Tessian Defender and Tessian Guardian. 
Building a human layer security culture “Humans will make mistakes.” That’s the blunt assessment of Arm CISO Tim Fitzgerald. Tim joined Arm in 2017 after spending years working on IT and information security at KPMG and Symantec. Since being acquired by Softbank in 2016, Arm has been investing significantly in the organization’s growth. On joining Arm, Tim kicked off an ambitious plan to improve his workforce’s understanding of security risks, while retaining a “high-trust” culture that emphasises “sharing, communication and collaboration as the basis of Arm’s success”. When Tim first began speaking to Tessian, he was seeking a more intelligent way to respond to isolated incidents of data loss that resulted from people not having enough salient information surfaced for them in real time. “Getting the fundamentals right”, for Tim, meant looking at the most prominent channels of communication and catalyzing change by focusing on the most important threat vectors within these channels. That meant looking at email, and particularly at how people behave – and slip up – on email.
Tailored real-time threat detection Over an initial proof-of-concept period, Arm straight away began seeing results. Thanks to Tessian’s ability to retroactively analyze historic email data, Arm was “immediately able to look back and pinpoint particular events that could have been avoided with Tessian’s software. That was a huge influence in our decision to move forward.” For Tim, Tessian’s reinforcement of best practice through delivering crucial contextual insight – giving people a beat to stop and think – is critical. “The value for us is that we’re effectively retraining the organization to look again at how they’re interacting with email in real-time.”
Eradicating ‘garden-variety’ vulnerabilities Under Tim’s leadership, Arm is continuing to invest in its security infrastructure by focusing on its people, and on flawlessly executing the basics of information security. In Tim’s view, “The ugly truth is that most threats to organizations stem from ‘garden variety’ vulnerabilities, and that includes humans.” Today, Tessian protecting employees from human error on email is a crucial part of Arm’s security strategy. Sometimes, focusing on the basics is the most important thing you can do.
Learn more about how Tessian prevents human error on email Tessian is building the world’s first Human Layer Security platform to automatically secure all human-digital interactions within the enterprise. Today, our filters use stateful machine learning to protect people using email and to prevent threats like spear phishing, accidental data loss, data exfiltration and other non-compliant email activity. To book a demo and learn more about how we can help your organization, click here.
Arm Case Study hbspt.cta.load(1670277, 'dc21b2ed-417f-498c-b2c0-c64e255b6143', {"region":"na1"});
Read Blog Post
Page