Security Operations Centers (SOCs) today are inundated with a staggering volume of phishing alerts that can overwhelm even the most seasoned analysts. This persistent onslaught strains resources, making it crucial to find solutions that can efficiently triage and neutralize threats. One of the companies facing this challenge is Asurion, the leading tech care and protection company providing insurance, repair, replacement, installation and 24/7 support for everything from cellphones to laptops and household appliances. Their 18,000 employees serve nearly 300 million customers – and that means their SOC is faced with a tremendous surface area to protect. Jason Morrow, Vice President of Cybersecurity, and Adam Gold, Senior Principal Architect, have been key drivers in strengthening security at Asurion.
Traditional email security is slow and cumbersome
Jason and Adam turned their attention to hardening email security because it was a primary method bad actors were using to target their employees. Email is a heavily used collaboration tool for Asurion employees. This made email security even more critical.
Native email security tools, while foundational, often involve slow and manual processes. Asurion security analysts felt this pain firsthand, with some repetitive processes eating up hours of time. Faced with the rising tide of attacks, they found they couldn’t investigate as deeply nor as quickly as they needed. While these attacks hadn’t yet led to catastrophic results, Jason and Adam knew they needed to quickly enhance their approach to email security.
Based on his past experience with secure email gateways (SEGs), Adam knew this traditional approach to supplementing native tools wouldn’t cut it. “The SOC team’s appetite for letting malicious messages get into mailboxes is low, but end users’ appetite for friction in accessing their email is also low,” Adam explains. A SEG wouldn’t meet his team’s need for a fast, easily-managed solution, and to make matters worse, it would negatively impact end users by blocking legitimate emails. Rather than turning the SOC into the “Team of No,” Jason and Adam wanted a solution that would be minimally visible to end users while being smart enough to block sophisticated attacks.
Tackling phishing at scale with Material
Jason and Adam believed that Material’s cloud office security platform offered a solution. Through Material’s API-based integration, the team was able to quickly run a POC. “The ease of implementation and testing of a POC was a huge win for us because there was no real downside to our architecture, our infrastructure, our technology team – all they had to do was essentially grant the permissions and it was off to the races,” says Adam.
“Some of the things that we see Material handle in under 10 seconds, take some of the native tooling in the tens of minutes to hours timeframe.” - Adam
During the POC, they learned that Material’s detections were, in fact, catching malicious messages. However, a key benefit was how much Material simplified the triage experience, with similarity-matching logic that consolidated large-scale phishing campaigns into single cases to be handled once. Before implementing Material, every user-reported phishing attempt triggered an individual alert that an analyst had to respond to and remediate. Now, reports are grouped, eliminating repetitive, tedious work and allowing more cases to be investigated. “It’s been a force multiplier for us – helping us avoid analyst burnout on phishing responses,” Jason Morrow notes.
“As a result of the similarity matching in Material, we saw a net reduction of 400 percent of emails worked because the tooling automatically clustered emails. An analyst didn’t have to search and identify all of those subtly different subject lines and take an action on each of them.” - Adam
As technical security professionals, both Jason and Adam like to dive deep into investigative work – looking closely at detection trends, matching logic, triage performance, and more. With Material’s underlying data platform, a structured and enriched data warehouse of historical email contents, they’re able to find what they’re looking for in seconds. You couldn’t put it better than Adam did in his own words: “the data warehouse is unreal.” And with a flexible engine that includes a number of built-in detections as well as the ability to create custom detections, they’re able to fine-tune their defenses to stay ahead of new types of attacks that evade traditional blockers around the perimeter.
Security is a team sport, and for something as critical as email security, it’s important to have a collaborative relationship. Jason and Adam have been in lock-step with the Material team since day one. From implementing feature requests to personalized data science insights, Material has helped make actionable sense of the email threat landscape. It’s a mutual respect: highly-engaged customers like Jason and Adam provide feedback that helps Material continue building out the advanced product capabilities.
“The Material team is highly engaged. They're in our real time communication channels with us. They go above and beyond in terms of delivery. And we see that time and time again. I mean, I can't say enough good things about them.” - Jason
.jpeg)
.png)
