A report published earlier this month has found that phishing is the leading cyber threat to European businesses. 150sec spoke to cybersecurity executive Arun Buduri to find out how AI may be the antidote to this prolific attack vector.
Europol’s European Cybercrime Centre published a strategic report recently on spear phishing, one of the most prevalent cyber threats currently affecting public and private organisations across the EU. A gmail-based phishing attack in 2017 cost $1 billion.
It’s estimated that the cost of cybercrime will reach $6 trillion globally by 2021. Cybercrime within Europe has been evaluated to count for up to 1.6% of GDP in some EU countries.
It’s estimated that the cost of cybercrime will reach $6 trillion globally by 2021.
Data from Annual Cybercrime Report published by Cybersecurity Ventures , 2016
Phishing: The art of deception
Phishing is all about deceiving people, explained cybersecurity expert Buduri. An employee clicks on a link in an email. The resultant fake web page is made to look like one that you would know and trust. It could be Paypal, Amazon or your own work/office login page.
The common element in this deception is how a phishing email and its resultant web page ‘looks’. The sophistication of these scams has changed over time. With that, it’s difficult to keep people on point as to what to look for.
Even worse, training employees seems only partially effective. The cybersecurity expert cited studies that 25% of employees still click on links even after anti-phishing training. And a single incident can cost companies millions: In 2014, a data breach cost Home Depot $179 million due to an employee opening an email from his junk folder.
If human vulnerabilities are the problem, the solution depends on “how you take the employee out of that equation”, claims Buduri. As a co-founder of Boston-based startup, Pixm, he believes that the problem can be tackled through computer vision-based AI.
Why is current software ineffective?
Buduri confirms that the current measures being taken against the phishing scourge are only partially successful. In many corporate environments, anti-phishing measures are applied via applications with built-in security protection, such as Office 365.
Additionally, organisations use stand-alone cloud-based security solutions which incorporate anti-phishing protection from companies such as Microsoft, Proofpoint, Mimecast, Cisco and Barracuda.
Despite this, these cloud-based solutions have been found to have a failure rate of up to 15%. That means that 15% of these bad phishing emails go through to your email inbox.
Buduri himself learnt of the shortcomings of cloud-based solutions just when he was about to take his own cloud-based product to market in 2017. “During the fundraising round, the product stopped working”, he recalled.
It was at that point that Buduri realised “that the attackers were blocking us from seeing the attack base from the cloud”.
The attacker knows it’s not the victim that’s trying to open the page, it is some security software in the cloud. Essentially, the attackers were blacklisting the entire cloud.
Startup with AI computer vision
Back to the drawing board, Buduri’s company has devised the worlds first on-device phishing protection. “We extend anti-phishing to all your devices and we shut attacks down at the point of click”, he clarifies.
“We extend anti-phishing to all your devices and we shut attacks down at the point of click
Arun Buduri, co-founder & president, Pixm.
The software runs all the time in the background on the users machine. Screenshots are sent to the application – which in turn uses AI computer vision in real-time – directly on the desktop or laptop.
Computer vision is used to detect what a login page should look like. The URL is then checked to see if it reflects the company the page otherwise purports to represent. If it doesn’t match, the system shuts it down – preventing the user from inputting their login credentials.
Buduri points out that nothing is 100% foolproof. Whilst this AI computer vision approach achieves 99% detection right now, the sophistication of hackers is ever increasing.
The entrepreneurs aim is to make the deception at the core of phishing attacks as difficult as possible. We will have to wait and see if the game is up on what has been the attack vector of choice for hackers.
This article features a client of an ESPACIO portfolio company.
