{
  "timestamp": "2025-02-05T22:16:46.603359",
  "model": "deepseek/deepseek-r1-distill-llama-70b",
  "request": {
    "messages": [
      {
        "role": "system",
        "content": "You are a product security specialist explaining security features and capabilities.\n            Focus on clear, user-friendly explanations of technical security features."
      },
      {
        "role": "user",
        "content": "\n            Provide a detailed analysis of the product security features described in:\n            \n            Content to analyze:\n            Search Free Trial Get Demo Phishing by the numbers  July 2021 August 24, 2021 The Cyren Incident and Response research team continuously collects phishing data and identifies the most effective phishing attacks using Cyren Inbox Security CIS, the companys flagship Inbox Detection and Response solution. CIS directly connects to Office 365, continuously detecting and automatically capturing phishing attacks that evade secure email gateways and arrive in a users inbox . This data provides insights about the scale and nature of evasive and targeted phishing threats, and why phishing continues to be a problem for many organizations despite investments in email security best practices and security awareness training. In July, the Incident and Response team identified nearly 20,000 confirmed email threats, which contained malicious content, and defied detection by third-party email security engines and the native security capabilities of Office 365. Key takeaways include Phishing continues to be the predominant email threat arriving in users mailboxes. Ransomware and business email compromise attacks are costly, but the data clearly illustrated that they are symptoms of previous successful phishing attacks. 93 contained phishing URLs 4 were business email compromise BEC or impostor emails 3 of messages included a malware attachment Figure 1 Types of email threats beyond the SEG Specialized detection and automated incident response are critical to eliminating threats before risky users do something they shouldnt. 97 of confirmed malicious incidents were detected before users read the messages. 94 of evasive threats were detected by Cyrens specialized engines and threat intelligence rather than helpdesk or SOC analysts. Threat intelligence is important but real-time analysis is critical for detecting evasive and zero-day email threats . 88 of evasive threats were detected with real-time techniques like machine learning. 6 were netted with proprietary threat intelligence or readily matched patterns of previous attacks heuristics. The remaining 6 were suspicious messages that required human analysis to confirm the detection User education matters but organizations must put it to good use, especially since most employees think phishing is ITs problem to solve. Providing the users with a tool for ad-hoc scans of emails before submitting them to the helpdeskSOC greatly reduces the volume of phishing alerts. 6 of total of confirmed phishing threats were triaged by end users rather than bogging down helpdesk or SOC personnel with basic or initial analysis. Of the messages submitted to the IDR platform, less than 2 were false positives. Phishing Attack of Note From July 16-17, Cyrens Incident and Response analysts noticed an attack that affected 192 users across 16 of our customers but with a few hallmarks of a highly targeted effort. This shows that some attackers have refined their tactics so they can automate attacks that used to require a high amount of manual effort. The senders name was spoofed and varied based on the target company . This is a typical trick used to associate the sender with an entity the users are likely to trust. The email subject related to an incoming voicemail. Again, this is typical. Phishing email subjects tend to mention voice messages, shipments, invoices, password resets, etc.  anything that creates some urgency but is also in keeping with our digital, mid-pandemic lives. There was no body text, just an attachment containing javascript. Criminals are increasingly putting phishing URLs or javascript in files to avoid the time of click protection offered by the SEG. The attachment contained code that would open an Office 365 phishing page that displayed the target companys logo and pre-completed the login form with the users email address. The fact that attackers were able to customize the look of the phishing page for each company is not something we see every day, at least not for an attack targeting so many companies at once. Figure 2 Targeted Office 365 phishing attack. The logo images and other identifying information have been redacted. This attack is a good example of the ability of bad actors to execute targeted attacks at scale through automation and abusing services and technologies designed to accelerate and secure digital transformation. Like many phishing attacks, this one targeted Office 365 credentials. Valid credentials would have allowed the attackers to access a variety of Office 365 services to launch devastating or email account compromise attacks and steal volumes of sensitive data. Inbox Detection and Response is a new category of anti-phishing solution designed to continuously detect and automatically respond to phishing, business email compromise, email account compromise, and other targeted email threats. Gartner  s name for IDR is Cloud Email Security Supplement CESS and Forrester calls it Cloud-native API-enabled Email Security CAPES. Try it for Free Instant Data Classification Cyren URL Category Chacker Prev Safe Links in Office 365 Square Enix Phishing Campaign Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443\n            \n            Your analysis should cover:\n            1. Key security features and capabilities\n            2. User benefits and protection measures\n            3. Integration with existing security systems\n            4. Compliance and certification details\n            5. Security best practices for users\n            6. Technical specifications and requirements\n            "
      }
    ],
    "model": "deepseek/deepseek-r1-distill-llama-70b"
  },
  "response": {
    "content": "### 1. **Key Security Features and Capabilities**\n\nCyren Inbox Security (CIS) is designed to detect and respond to phishing attacks and other email-based threats that evade traditional email security systems. The solution offers the following key features:\n\n- **Continuous Monitoring**: CIS directly integrates with Office 365, continuously scanning inboxes for phishing attacks, malware, and other threats in real time.\n- **Advanced Threat Detection**: Utilizes specialized engines, machine learning, and threat intelligence to identify evasive and zero-day threats that bypass secure email gateways (SEGs) and native Office 365 security.\n- **Automated Incident Response**: Automatically captures and isolates phishing threats, reducing the risk of users interacting with malicious content.\n- **Real-Time Analysis**: Combines machine learning and threat intelligence to detect and block threats as they emerge, ensuring timely protection against dynamic attackers.\n- **User-Driven Threat Submission**: Allows end-users to submit suspicious emails for analysis, reducing the burden on helpdesk and SOC teams while empowering users to contribute to security.\n\n### 2. **User Benefits and Protection Measures**\n\nCIS provides several benefits that enhance user protection and streamline security operations:\n\n- **Early Threat Detection**: 97% of confirmed malicious incidents were detected before users could read or interact with the messages, significantly reducing the risk of phishing success.\n- **False Positive Reduction**: Less than 2% of submitted emails were false positives, ensuring that legitimate emails are not mistakenly flagged or blocked.\n- **End-User Empowerment**: Users can submit suspicious emails for analysis, fostering a culture of security awareness and reducing the workload on security teams.\n- **Protection Against Advanced Threats**: CIS detects and blocks highly targeted attacks, including those that spoof senders, use urgency-based subject lines, and incorporate malicious attachments or URLs.\n\n### 3. **Integration with Existing Security Systems**\n\nCIS is designed to integrate seamlessly with existing security infrastructure:\n\n- **Office 365 Integration**: Directly connects to Office 365, ensuring compatibility and ease of use without disrupting existing workflows.\n- **Complementary Security**: Works alongside secure email gateways (SEGs) and other security tools, enhancing their capabilities by addressing gaps in detection and response.\n- **SOC and Helpdesk Compatibility**: Automatically processes threats, reducing the need for manual intervention by SOC analysts and helpdesk personnel.\n\n### 4. **Compliance and Certification Details**\n\nWhile specific compliance certifications are not detailed in the provided content, CIS is likely designed to meet common industry standards for email security and data protection, such as GDPR, CCPA, and ISO 27001. The solution\u2019s ability to detect and block malicious content in real time, along with its automated incident response capabilities, supports compliance with regulations requiring timely threat detection and response.\n\nOrganizations should verify the specific certifications and compliance capabilities of CIS during their evaluation process.\n\n### 5. **Security Best Practices for Users**\n\nTo maximize the effectiveness of CIS and enhance overall email security, users should adopt the following best practices:\n\n- **Stay Vigilant**: Be cautious of emails with urgent subject lines, unfamiliar senders, or requests for sensitive information.\n- **Report Suspicious Emails**: Use the ad-hoc scanning tool to submit suspicious emails for analysis, helping to improve detection and response.\n- **Avoid Clicking on Links or Opening Attachments**: Refrain from interacting with links or attachments from untrusted sources until the email has been verified as safe.\n- **Regular Security Awareness Training**: Participate in training sessions to stay informed about the latest phishing tactics and how to avoid falling victim to them.\n\n### 6. **Technical Specifications and Requirements**\n\nWhile the provided content does not include detailed technical specifications, the following can be inferred:\n\n- **Cloud-Based Solution**: CIS is a cloud-native solution, likely requiring minimal on-premises infrastructure and supporting scalability for organizations of all sizes.\n- **Browser and Email Client Compatibility**: The solution is designed to work with Office 365, so compatibility with popular browsers and email clients is expected.\n- **Real-Time Processing**: Utilizes real-time analysis and machine learning, requiring a stable internet connection for optimal performance.\n- **Scalability**: Given its integration with Office 365, CIS is likely scalable to accommodate organizations with large or distributed workforces.\n\nFor specific technical requirements, organizations should consult Cyren directly to ensure compatibility with their existing infrastructure and security architecture.",
    "usage": {
      "prompt_tokens": 1072,
      "completion_tokens": 1491,
      "total_tokens": 2563
    },
    "model": "deepseek/deepseek-r1-distill-llama-70b"
  }
}