To deliver an enhanced and redesigned experience for your customers, Mimecast is introducing the CyberGraph 2.0 platform. 

CyberGraph 2.0 - Overview

This page provides an overview of CyberGraph 2.0. To see what's changed with CyberGraph 2.0, view the What's New article here: CyberGraph - CyberGraph 2.0 - What's New.

Product Overview

CyberGraph is an optional add-on to Email Security Cloud Gateway and a component of Email Security Cloud Integrated, hosted on AWS. It uses artificial intelligence, machine learning, and social graphing to detect anomalies by mapping sender-recipient communication patterns. It empowers employees to make smarter mail-processing decisions. 

 

Using identity graphing technology, CyberGraph builds a social graph that stores information about relationships and connections between senders and recipients, including the strength or proximity of the relationships. It learns what is “normal” and detects anomalous behaviors that can be combined with other suspicious indicators to determine the risk associated with an email. 

 

CyberGraph empowers users to make smarter choices about their email responses. To see the improvements we're making to CyberGraph 2.0, view the What's New article here: CyberGraph - CyberGraph 2.0 - What's New.

 

Banners 

CyberGraph alerts email recipients to indicators of risk with contextual warning banners.  Colored banners indicating the level of risk are added to suspicious emails before delivery. They provide the recipient with enough information about the nature of the threat to engage them at the point of risk when they are about to action the email. The banners and wording for each indicator can be customized to meet each organization's users' needs and knowledge levels.  

The Dynamic Banners are embedded in emails as they are inspected and classified as suspicious, enabling any given banner to be updated, including changing its color, at any time as new information about the risk indicators is received. Banners are displayed regardless of the device type or email client, and they do not interfere with the display format of the email preview or subject lines. 

For example, suppose an email with a blue Information banner is later reported as malicious, and this is verified when analyzed. In that case, the banner can be automatically changed to “Warning” red, and the next time any recipient of a similar email opens it, they are presented with a red banner. This is a highly effective way to maintain user engagement, rather than static banners that don’t reflect the latest information, which users become “blind” to.

Furthermore, CyberGraph engages and empowers the user. In each Banner, the user can choose to Report or Mark Safe. When a user reports an email as malicious, your organization administrator is notified, and the mail is sent to the Mimecast Mail Security Operations Center (MSOC), where a security analyst reviews it. Based on experience and other contextual inputs across Mimecast, the analyst dispositions the mail as safe, malicious, or (harmless or harmful) spam.  In addition, all disposition feedback from MSOC and the user updates the machine learning model with information about trust relationships between senders and recipients. The data can also be crowd-sourced to feed Mimecast’s threat intelligence and benefit all customers. 

 

Misaddressed Email Protection 

Another pillar of CyberGraph protection is Misaddressed Email Protection, which, unlike Banners, works on outbound emails.  

 

Using artificial intelligence and leveraging the relationship information within the Mimecast social graph, Misaddressed Email Protection (MEP) identifies and prevents possible data loss caused by employees accidentally sending emails to the incorrect recipient. This solution prevents simple mistakes from developing into security incidents by alerting senders of potentially misaddressed emails immediately after they click Send. MEP then prompts users to release or hold the just-sent email. CyberGraph administrators maintain full visibility into emails identified by Misaddressed Email Protection, including supplemental information and why they were held. 

 

This feature is only currently available to CyberGraph Cloud Gateway customers.

 

Image Tracker Removal 

The third pillar of CyberGraph protection is Image Tracker Removal (“Tracker”). This feature provides protection from trackers in images which may be used by attackers to gather data about a recipient’s device and activities to craft a subsequent spear phishing attack. For more information on these types of attacks, see Trackers.

 

The Tracker feature finds and removes images from processed emails and rehosts them to a safe Mimecast storage location, thus hiding the actual user interaction from the sender and preventing the data collection.

 

For more information on CyberGraph features and implementation steps, refer to the list of feature oriented Knowledge Base articles here.