Hornetsecurity Advanced Threat Protection (ATP) detects phishing attacks, CEO fraud and ransomware from the first email and ensures that they cannot cause any damage. For this purpose, Hornetsecurity ATP relies on a unique package of protection mechanisms such as sandboxing, URL rewriting, URL scanning and freezing as well as several forensics systems. The package also includes real-time notifications – immediate, automatic notification of the customer in case of attack. Protection from targeted attacks Mostly high-ranking employees are targeted by individual attacks like spearphishing, whaling or CEO fraud. Unfortunately, those kinds of attacks is almost invisible to regular filtering systems. Hornetsecurity ATP is using a whole range of detection mechanisms to prevent those types of attacks. Protection from Ransomware Ransomware is polymorphous viruses like Locky, Tesla or Petya that paralyze a computer or a whole network by encrypting the locally stored files. Hornetsecurity ATP exposes these hard-to-find viruses using a sandbox engine and the freezing technology, where suspicious emails are withheld for a specific period of time until they are analyzed again with updated signatures. Protection from blended attacks Blended attacks combine several attacking routes. An email, for example, can contain a file attachment which can carry the link to a download page with malware. Hornetsecurity ATP fights these kinds of attacks by using URL scanning and URL rewriting. Additionally, sandboxing and freezing is used, too. Protection from digital espionage According to Germany’s digital association Bitkom, more than half of all German companies have already been affected by data theft, sabotage or espionage. The Hornetsecurity spy-out forensic system detects not only familiar but also completely new malware that tries to collect information. The system reacts in real-time and immediately alerts the IT security teams before sensitive data can leave the company. Notification of attacks The Hornetsecurity real-time alerts provide notifications of acute attacks on companies and allow a quick initiation of additional internal measurements and juridical proceedings. Additionally, employees can be sensitized in order to detect further attacking routes, e.g. via telephone. In case an already delivered email is detected as potentially dangerous, the ex-post alarm can initiate an analysis of the contaminated accounts or systems.
Hornetsecurity ATP integrates seamlessly into the spam and virus filter. Mails that have passed this first examination will undergo further detailed analyses. Amongst others, the service opens the attached files and is closely checking its behavior.