Phishing and social engineering
Detecting and stopping attacks on people rather than machines – from fake emails to CEO fraud.
Most successful cyber attacks do not start with a software vulnerability, but with a message to a person.
With artificial intelligence, phishing emails become flawless and personal. Fake voices and videos are hard to tell from the real thing.
Threats to your company
- Fake emails and login pages that harvest credentials
- CEO fraud: a supposed managing director orders an urgent, confidential transfer
- Invoice fraud: a supplier supposedly reports new bank details
- Targeted attacks on executives, assistants, accounting and IT
- Calls with cloned voices and fake video conferences
- Malware in attachments as the entry point for ransomware
- Information gathering through social networks and fake job applications
Typical problems
- Technical filters often miss well-made, personalised attacks.
- There is training, but not on the schemes aimed specifically at your company.
- Under time pressure, approvals are bypassed. The four-eyes principle does not apply to “the boss”.
- After an incident there is no procedure: who informs the bank, the police and the data protection authority – and by when?
- Publicly available information about your company gives attackers the script.
Financial consequences
- Direct losses from transfers that can rarely be recovered
- Business interruption from ransomware, plus ransom demands and recovery costs
- GDPR fines of up to 20 million euros or 4 % of worldwide annual turnover
- Damage claims from customers and partners whose data is affected
- Personal liability of management and board for inadequate protection
- Reduced insurance payouts if agreed protective measures were missing
Our approach
- Analysis: what information about your company and your executives is public?
- Realistic phishing and phone simulations, agreed with management and the works council
- Training for particularly exposed roles: management, assistants, finance, IT
- Procedures for payments and account changes that hold up under pressure
- Emergency plan and support after an incident
A suspicion is best clarified early.
Tell us about your concern. We will get back to you personally and confidentially.