THREAT TYPE

Account Takeover

An Account Takeover attack is a form of BEC and is typically the result of a Credential Theft attack. Unlike an impersonation attack, an Account Takeover is not a “look-alike” domain, but rather a legitimate business email that have been taken over by the bad actor using stolen credentials.

External Account Takeover

An External ATO is the result of an attacker compromising a trusted third-party partner or vendor leveraging a Credential Theft or BEC attack to continue the attack campaign by targeting the victims trusted external network for financial gain.

Internal Account Takeover

An Internal ATO is the result of an attacker successfully running a Credential Theft or BEC attack within the organization to gain access to an employees account so they can exfiltrate sensitive data or continue the attack campaign against the organization’s trusted external network

AI BASED THREAT DETECTION

Tessian AI Explained

Tessian uses an ensemble of AI based approaches because it's the only way to defend against advanced phishing attacks, and protect against sensitive data loss on email. Through behavioral, content and threat network analysis, Tessian AI automatically adjusts as our customers hire, acquire, and adapt.

Behavioral Detection

Detects Anomalous Sender

This email domain passes all authentication checks (DKIM, DMARC, SPF) because it is a legitimate trusted email domain. However, the sending IP address point to Vietnam, whereas the legitimate sender typically sends form England and sometimes the US based on email communication history.

Behavioral Detection

Detects Anomalous Behavior

Based on email communication with this trusted sender, the sender has never used or referenced Sharepoint as a file sharing service before. While not malicious, this anomaly indicates a change in behavior that is unusual.

Behavioral Detection

Detects Anomalous URL

The email links to a legitimate file sharing site, Microsoft Sharepoint, but the file being linked is malicious. Sharepoint URLs are typically sent from no-reply@sharepointonline.com, indicating that this instance is a Sharepoint impersonation.

“Tessian stops email threats, including Phishing, Business Email Compromise and attacks which could lead to Ransomware or Credential theft on a daily basis. Without Tessian, these threats would've reached our end users.”

Jason Patterson, Sr Director; InfoSec, Compliance and Risk Management @ Nasuni

Simple stack that deploys in minutes

Tessian is built to augment Microsoft and Google, allowing you to enhance your investments and move beyond your secure email gateway. Tessian is deployed in minutes through native API integrations, add-ins or mail gateway.