Safeguarding Employees and Clients at Mariner Wealth Advisors with Zero Trust Email Security

Phishing Response: Addressing Time to Remediation

Financial services firms are a top target for threat actors with the involvement of sensitive information. It’s no surprise that Mariner Wealth Advisors’ security team sees frequent spear phishing attempts.

The security team would spend hours working through a phishing incident using Office 365’s built-in tooling. “If we saw a threat and tried to run a search within a few minutes, we had to wait for indexing before we could even run an investigation," says Chris. We’d see it, wait 10 mins, then run a soft delete. Is this an incident? Do we need to log? What was the magnitude? This became a full time job.”

The team also had to fall back to writing queries in Powershell to seek out similar messages and senders, find other recipients, and then remediate. It was “a race to the keyboard.”

On top of that, there was an exposure time gap between the first phishing email hitting a user’s inbox and when the team could remediate. In that time, employees could fall victim to a malicious link or file, or reply or forward those emails to others. Even with an outsourced SOC to help with repetitive daily phishing incident response tasks, the team still needed help with their #1 metric: time to remediation.

The team deployed Material’s Phishing Protection to help provide real-time remediation. Here’s how it works:

1. An employee flags a message that gets through as suspicious (using existing training workflows).
2. Material helps automatically find and cluster similar messages across the organization as the attack unfolds.
3. The security team sets customized, auto-remediation rules so that the organization is instantly protected with one user’s report. Manual security review becomes less urgent.

With a seamless two week rollout to the employee base, user training was as simple as “click this new button instead of the old button”. The helpdesk is usually overwhelmed with requests when deploying new services. But in this case, the team didn’t hear a single complaint. The security team could also share feedback with Material’s built-in reporting (e.g. the attack hit 10 mailboxes, 1 user clicked on the link, and we remediated within 45 seconds). Users felt empowered that they could help protect the organization instantly.

Users appreciated the simplicity, and Mariner Wealth Advisors saved tens of thousands of dollars by removing third party phishing triage costs. Plus with the automatic clustering, the team no longer had to conduct manual searches in investigations. This helped free up the analysts’ time to focus on strategic new features and progress other security programs.

Protecting Sensitive Data in Employee Inboxes

Mariner Wealth Advisors also wanted to protect any sensitive data and files sitting in users’ inboxes and archives. But in order for the security team to quantify the risk for management, such as how many credit card numbers, social security numbers, and other sensitive data types were in existing mailboxes, they faced a ton of manual work that took away from other projects.

The data gathering started with message searches which were very time consuming, not sustainable, and nowhere near real time. Then they’d have to run analysis on top of the data to get to anything actionable. This was also only a single point in time. To be able to do this continuously, they would need full time resources.

Users and executives were typically skeptical of new security controls. But Thomas and Chris used these data-backed risk findings to justify the urgency to improve data protection in the inbox. "The risk analytics from Material helped provide the data we needed for executive buy-in. It helped identify any potential risks we had in the mailbox and prioritize accordingly," recalls Chris. Rather than push back, executives ended up champions with this new visibility into risk. 

Now that all were onboard, the team needed to secure the sensitive content in email while not disrupting user workflows. Material’s Data Protection solution checked all the boxes. Any emails with sensitive content were automatically found and redacted. When users needed to retrieve a message, they just needed to use their existing Okta app to authenticate access and “unlock” the message.

Extending the Zero Trust Mentality to Email

Email is Mariner Wealth Advisors’ main communication tool and thus the #1 platform they focus on de-risking. Knowing that no solution is ever 100% perfect in catching threats, Mariner Wealth Advisors needed a zero trust strategy for email. Chris underscores: "Material helped us flip our email security strategy on its head. We have visibility the other way around now - we’re proactive vs reactive. I tell everyone about Material."

Mariner Wealth Advisors' inside-out approach helped secure users and clients while maintaining productivity.

‍