EVERYCLOUD SECURITY LIMITED

Ironscales - Mailbox-Level Phishing Protection

Ironscales is a mailbox-level, self-learning, AI-driven email security platform; which continuously detects and remediates advanced threats like BEC, credential harvesting, account takeover and more in your company’s mailboxes.

Features

• Mailbox-level email security in a threat intelligence platform
• Business Email Compromise protection (BEC), customisable email templates
• Account Takeover protection (ATO), phishing simulation
• Protection against Impersonation Attempts
• Protection against Spear Phishing and Credential Theft
• Automatic mail triage and response, user notifications
• AI and ML powered incident response
• Malware and URL Protection, stop modern phishing attacks
• Democratised Threat-Hunting across a global community customer-led database
• Email banner alerts, threat intelligence, spam and junk mail protection

Benefits

• Save time in discovery and remediation for your IT staff
• Reduce the risk of opening malicious files or links
• Reduce the risk of malware, ransomware and credential harvesting
• Fight polymorphic and zero-day attacks
• Initial 90 day scanbacks of all your company mailboxes
• Integrate email security and awareness training into a single platform
• Dynamic warning banners to avoid banner fatigue
• Avoid compromise and takeover of VIP mailboxes and accounts
• Expand your threat detection team with a global community
• Train employees within the platform with bespoke phishing simulation

£42 a unit a year

• Free trial available

Service documents

• Pricing document

  PDF

• Skills Framework for the Information Age rate card

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at contracts@everycloud.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 13

Service ID

904846436147299

Contact

Paul Richards
02078872824
contracts@everycloud.co.uk

Service scope

• Software add-on or extension: Yes
• What software services is the service an extension to: Add-on service to G-Suite Premium or Microsoft 365 suite.
• Cloud deployment model: Public cloud
• Service constraints: No planned maintenance constraints.; A basic internet connection is required to access this solution through supported browsers: Chrome, Safari, Edge.; Not intended to run on mobile devices unless using the mobile application.
• System requirements:
  • Microsoft 365 business license
  • G-Suite Premium license
  • Microsoft Exchange On-Premise

User support

• Email or online ticketing support: Email or online ticketing
• Support response times: Critical Support: Less than 24 hours.; All other support (High, Medium, Low): Less than 1 business day.
• User can manage status and priority of support tickets: No
• Phone support: Yes
• Phone support availability: 24 hours, 7 days a week
• Web chat support: No
• Onsite support: No
• Support levels: Standard support is provided between the hours of 2:00am to 5:00pm Monday to Friday and 2:00am to 11:00am Sunday.; ; This is provided via phone, email or ticketing support.; ; Initial response times:; Critical Support: Less than 24 hours.; All other support (High, Medium, Low): Less than 1 business day.; ; All support should initially come through the reseller via email or phone.
• Support available to third parties: No

Onboarding and offboarding

• Getting started: Customers are supported through the onboarding process by a series of planned virtual meetings to ensure full operation of the service within the client's environment. Training videos and documentation are also available via an online customer portal which all customers are given access to throughout their contract.
• Service documentation: Yes
• Documentation formats: HTML
• End-of-contract data extraction: No user data is stored by Ironscales.
• End-of-contract process: In a given period, a customer can choose to continue with the service by contracting into a renewal or they may cease to use the service and terminate the contract. In this case, access to the service is revoked and the client environment is not affected in any other way.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Chrome
  • Safari
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: Mobile application provided for admin response and remediation only.
• Service interface: Yes
• User support accessibility: None or don’t know
• Description of service interface: Administration interface accessed via a web browser.
• Accessibility standards: None or don’t know
• Description of accessibility: The admin dashboard is a responsive web app which adheres to any device accessibility settings the user has enabled. Any imagery contains alt-text which is descriptive in the case where an image is not purely graphical. All information provided by imagery is also provided by text-values.
• Accessibility testing: Thorough testing completed by internal quality assurance teams as well as external testing completed by customers and other external users.
• API: Yes
• What users can and can't do using the API: Ironscales can pull information in from other SOAR services such as Wildfire, Metadefender and utilise this intel to detect malicious files without having to run any files through the sandbox detection. The Ironscales API can also share information out to SIEM solutions such as Splunk.
• API documentation: Yes
• API documentation formats: HTML
• API sandbox or test environment: Yes
• Customisation available: No

Scaling

• Independence of resources: The Ironscales cloud solution is hosted using AWS.

Analytics

• Service usage metrics: Yes
• Metrics types: Metrics/reports are available to the client from within the service.; There are a wide range of reports available, many of which are customisable.; Examples: number of inspected mailboxes, number of detected incidents, phishing resolves, spam resolves, safe mail resolves, total remediations, number of malicious link detections, display name impersonations, number of manual incident reports, 'time saved' and median resolution times.
• Reporting types:
  • Real-time dashboards
  • Regular reports

Resellers

• Supplier type: Reseller providing extra support
• Organisation whose services are being resold: Ironscales Ltd

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Up to Security Clearance (SC)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations:
  • European Economic Area (EEA)
  • Other locations
• User control over data storage and processing locations: No
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 3.0)
• Penetration testing frequency: At least every 6 months
• Penetration testing approach: ‘IT Health Check’ performed by a Tigerscheme qualified provider or a CREST-approved service provider
• Protecting data at rest: Physical access control, complying with CSA CCM v3.0
• Data sanitisation process: No
• Equipment disposal approach: A third-party destruction service

Data importing and exporting

• Data export approach: No user data is stored by Ironscales.
• Data export formats: Other
• Other data export formats: None
• Data import formats: CSV

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: The service availability mirrors that of Amazon Web Servers (AWS) SLAs.
• Approach to resilience: As per Amazon Web Servers (AWS) terms, this service is duplicated over multiple sites to ensure undisrupted service availability.
• Outage reporting: Email alerts.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • 2-factor authentication
  • Identity federation with existing provider (for example Google Apps)
  • Username or password
• Access restrictions in management interfaces and support channels: Only administrators are granted access to the service interface.
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • 2-factor authentication
  • Identity federation with existing provider (for example Google Apps)
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: Between 1 month and 6 months
• Access to supplier activity audit information: Users have access to real-time audit information
• How long supplier audit data is stored for: Between 1 month and 6 months
• How long system logs are stored for: At least 12 months

Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: IQC
• ISO/IEC 27001 accreditation date: 03/04/2016
• What the ISO/IEC 27001 doesn’t cover: Anything beyond the development, marketing, sales and services regarding information security in the field of phishing.
• ISO 28000:2007 certification: No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: No
• Cyber essentials plus: No
• Other security certifications: Yes
• Any other security certifications: AICPA SOC-2

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: Ironscales follows guidance and policy documented in the official acts such as GDPR and Privacy Shield for EU-US.; Staff are trained on a regular basis to ensure adherence to these policies.

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: All change management requests are evaluated internally and if approved, signed off and approval is granted.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: We utilise a series of technologies and services to monitor our network for vulnerabilities.; Patches are reviewed, tested and deployed weekly in arrears.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: Ongoing monitoring of the solution and operations. Any compromises are flagged to the relevant departments, services can be suspended on a single tenant basis dependant on the severity of the compromise. Severe compromises are acted upon immediately for resolution as soon as possible.
• Incident management type: Supplier-defined controls
• Incident management approach: Incidents can be reported by users by phone, support email or submitting a ticket via the online portal. The incident will be raised to the relevant department dependant on the type of incident. Any remediation will be actioned as soon as possible and the reporting user will be informed and updated on a regular basis and once remediation is complete.

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v3.0)

Public sector networks

• Connection to public sector networks: No

Social Value

• Fighting climate change:

  Fighting climate change

  EveryCloud are committed to conducting business in a manner which causes minimal damage to the environment. EveryCloud encourages proactiveness by employees in respect of this commitment and all managers are required to consider any reasonable suggestions made by employees, whose aim is to minimise the environmental impact of the company’s activities. We support this by using more virtual meetings, minimising the requirement to travel, striving for a paperless office, and promoting the cycle to work initiative.
• Covid-19 recovery:

  Covid-19 recovery

  EveryCloud are committed to helping local communities to manage and recover from the impact of COVID-19 by undertaking a range of activities around the ‘return to work’ process for our employees. Offering various opportunities for work experience to local universities and colleges in the area and the use of apprenticeships to address gaps within the current workplace. Through our partnership with Everton Football Club we support Everton in the Community’s launch of an innovative education STEAM programme for schools across Merseyside – combining football with robots for schools to engage and motivate young people from disadvantaged areas and transform the way children learn about technology by donating ipads.; EveryCloud supports an employee-led volunteering initiative to tackle loneliness in the elderly community by hosting afternoon teas and providing a social space for the local community three times a year and allowing employees time for volunteering in local schools and with photography projects.; EveryCloud also have a Trustee on the Board of Greater Sport which is a charity focused on changing lives through sport and physical activity uniting communities and creating more equal and inclusive places to enable the community to come together to lead happier, healthier and more fulfilled lives.
• Equal opportunity:

  Equal opportunity

  EveryCloud have a Trustee on the Board of Greater Sport which is a charity focused on changing lives through sport and physical activity uniting communities and creating more equal and inclusive places to enable the community to come together to lead happier, healthier and more fulfilled lives.; Through our Board of Directors EveryCloud are a regular judge for the Northern Power Women Awards and sit on the Northern Power Women Board which is dedicated to accelerating gender equality and social mobility. EveryCloud also has a director presence on the Inclusive Companies Awards supporting organisations to create more inclusive workplaces. Specialising in male advocacy for gender balance; and equity for ethnic minorities. Inclusive Companies exists to challenge the lack of diverse representation within UK based organisations and to assist employers in fostering a truly inclusive environment within which they recognise and value the differences of each employee.; Through our partnership with Everton Football Club we support Everton in the Community’s launch of an innovative education STEAM programme for schools across Merseyside – combining football with robots for schools to engage and motivate young people from disadvantaged areas and transform the way children learn about technology by donating ipads.
• Wellbeing:

  Wellbeing

  EveryCloud is committed to providing a working environment which promotes and maintains the health and wellbeing of its staff and all other personnel engaged in work on projects. EveryCloud recognises the importance of investing in the health and welfare of its staff by providing a physical and social environment which is conducive to teaching, learning, living, and working. The company will foster an ethos associated to fairness, inclusion & respect towards all our employees and have an appointed employee to oversee the wellbeing within the work place. EveryCloud have committed to the ‘Six Standards within The Mental Health at Work Commitment’ which we follow to improve and support the mental health of our employees.; EveryCloud is committed to raising awareness of mental health and encouraging healthy discussion by boosting employee’s knowledge and skills so they can better manage their mental health and improve their ability to support that of others. Mental health is embedded in our induction and training, and all staff are given information on how best to manage mental health; support is available as per our Mental Health at Work Policy. EveryCloud has an appointed Mental Health Champion who is committed to regularly organising company events, promoting healthy eating and changing the way that our employees think and act about mental health.; EveryCloud has a healthy work hours policy and supports a full campaign to allow staff to take lunch breaks and allows additional time out of the working day to attend all family and volunteering events. Staff are encouraged to take their full annual leave entitlement and to avoid working at weekends with time in lieu given for attendance of events outside of working hours.

Pricing

• Price: £42 a unit a year
• Discount for educational organisations: No
• Free trial available: Yes
• Description of free trial: 30-day Proof-of-Concept with unlimited capability
• Link to free trial: https://www.everycloud.co.uk/contact

Service documents

• Pricing document

  PDF

• Skills Framework for the Information Age rate card

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at contracts@everycloud.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.