Protect your business from cybersecurity attacks with Proton Mail

Share this page

Cybersecurity attacks are on the rise. The majority of these attacks involve malware, but phishing attacks are also a major concern. The Anti-Phishing Working Group (APWG) saw over 1 million phishing attacks in the first quarter of 2022 alone, an unprecedented total. 

Small to medium-sized businesses (SMB’s) may think they are too small to target, but a recent report from Acronis shows that they’re increasingly vulnerable due to increases in cyberattack automation. The primary attack vector is phishing, with 94% of malware coming via email. 

The security outfit Kaspersky’s estimates the cost of cyberattacks to SMBs at around $86,500 and enterprises at “a staggering” $861,000. These figures take all factors into account, including lost business, additional money spent on public relations, hiring professional IT staff to fix the problem, and so on.

Small businesses are particularly vulnerable to cybersecurity attacks because they rarely have the resources to mitigate them or the know-how to prevent them. According to the UK government report, the primary vector for 83% of cyberattacks is via email (phishing). This is particularly concerning because 92% of data breaches result from phishing attacks.

And the number of these data breaches has increased dramatically, with reports from the first quarter of 2022 showing a “cyberdemic” affecting all levels of business, including big-name companies such as LastPass, Plex, Cisco, Uber, Plex, Verizon, and many more

This article discusses how email-based cyberattacks work and how Proton Mail can help protect your business against them (and save your business money). 

Phishing and other kinds of email-based cyberattacks

Phishing

A form of social engineering, phishing describes a cybersecurity attack in which a criminal sends you an email that appears to be from a legitimate source but which is, in fact, fake. If you click on a link in the fraudulent email, you’ll download malware or be sent to a website that also looks legitimate but isn’t.

If you attempt to sign in to this fraudulent website, the criminal will get your login details.

Most phishing attacks aim to reveal your bank details, but because many people reuse the same email and password across multiple websites, subtler phishing attempts may attempt to lure victims in by masquerading as websites less likely to raise suspicion. 

Spam

Over 400 million spam emails are sent per day, accounting for around 84% of all email sent. Although not an “attack” per se, this avalanche of digital junk costs businesses billions in lost productivity each year. A survey found that, even then, employees spent an average of 6.5 minutes per day managing spam, amounting to a yearly productivity loss of 1.4 percent.

Lateral phishing

This devious phishing attack abuses your assumption that emails sent from within your company are not suspicious. The attacker takes over an account within your business and uses it to send more convincing phishing emails to your employees and external business contacts. 

The primary aim of most lateral phishing attacks is to steal confidential company credentials. Security outfit Barracuda in collaboration with researchers from UC Berkeley and UC San Diego found that “one in seven organizations experienced lateral phishing attacks over the past seven months”.

The researchers also identified 154 compromised accounts that sent out over 10,000 phishing emails, 40% of which were to employees within the same company as the hijacked email account.

Spoofing

Spoofing attacks involve emails that use a forged sender address, making it more likely the emails will be opened. They’re usually used to deliver spam, phishing, or malware attacks.

Business email compromise (BEC)

Also known as a Man-in-the-Email scam or email account compromise (EAC), BEC attacks appear to come from a trusted source who requests a fraudulent money transfer.

Often involving a strong element of social engineering to convince the victim that the email is genuine, a typical attack purports to come from a CEO or other company executive authorized to request money transfers. However, BEC attacks  can also target victims outside the business office (for example, a homeowner can be asked to make a downpayment on their property).

The FBI lists five common forms of BEC attack and reports that between October 2013 to July 2019, they have globally cost businesses $26 billion (with a 100% increase in reported losses between May 2018 and July 2019). 

Spear phishing

As its name suggests, this is a variant phishing attack that targets specific individuals or small groups. The attacker usually combines careful research and social engineering to convince the victim that the email is genuine. For example, the email might discuss the victim’s role within your company.

Whale phishing (or “whaling”) is a spear phishing attack that targets a rich, famous, or powerful individual (because whale = “big phish”).

How can Proton Mail prevent phishing?

Cybercrime is a multi-billion dollar industry that encompasses a broad range of threats. Effective prevention requires employing a wide-spectrum approach to protecting your business.

This includes strong anti-malware defenses, robust security policies (with appropriate education and training for staff), and continuous monitoring of your systems. Deployed as part of a holistic approach to cyberdefense, Proton Mail can help defend against some of the most common email-based cybersecurity threats. 

Multiple email addresses

An effective way to defend against email attacks is to limit the number of people who know your real email addresses. Proton allows you to create multiple email addresses (including email addresses using your company’s custom domain with a Proton for Business plan), plus an unlimited number of +aliases.

Learn about using multiple email addresses with Proton Mail

You could, for example, set up an email address to give out freely, plus one or more email addresses you only use for sensitive communications, such as an email address you only use for your bank.

In this example, any email claiming to be from your bank that does not use your dedicated banking email address is almost certainly a phishing attempt. 

And now that Proton has joined forces with SimpleLogin, it’s even easier to hide your real addresses with on-the-fly email aliases that you can easily create, delete, block, and manage.

Link confirmation

This simple but effective phishing defense, enabled by default in all our apps, asks you to confirm that you wish to open an external link from an email. We strongly advise that you always take this opportunity to read the full link to see whether it’s genuine.

Learn more about link confirmation

Address verification

This advanced feature allows you to manually trust PGP keys for specific contacts. This can benefit your business’s cybersecurity by giving you full control over which keys you choose to trust. 

Learn more about address verification

Lock icons

You can easily identify the encryption status of emails you receive using lock icons shown on each email. 

A lock icon tells you encryption status of emails
  • A blue lock means the email was sent from a Proton Mail address. It is not possible to spoof emails from Proton Mail accounts. 
  • If your organization uses Proton Mail, this also provides a guarantee that someone within your organization sent the email.
  • A green lock denotes a PGP-signed message. A PGP signature guarantees that the sender is genuine and that the message hasn’t been tampered with.
  • A blue or green lock with a checkmark shows that you have manually chosen keys to trust with this contact (Address verification).

Learn more about how to check encryption status using lock icons

Learn more about how to protect yourself from phishing attacks

Data breaches

A data breach occurs when sensitive information held by a company is made available in an unauthorized way.   

Data breaches can result in competitors gaining access to what should be privileged information about the internal workings of your company. However, the most devastating, high-profile, and common data breaches are when a company leaks personal details belonging to users and customers. 

For example, in July 2022, Uber admitted to a 2016 data breach that affected 57 million passengers and drivers and that it paid the attackers $100,000 to keep the breach secret. Even more dramatically, T-Mobile suffered a data breach in 2021 that affected some 76 million users, resulting in a $350 million settlement to a class action lawsuit.

How can Proton Mail prevent data breaches?

End-to-end and zero-access encryption

Emails sent between Proton users are end-to-end encrypted (E2EE). It is also possible to send E2EE emails to non-Proton users using PGP or Password-protected Emails. This means they are encrypted on your device and can only be read by the intended recipient. No one else, including us, can read them.

We have no control over how non-E2EE emails sent to people who don’t use non-Poton Mail are stored on their provider’s servers, but when stored on our servers, they are secured using zero-access encryption. That is, they are encrypted using your public key, so only you can decrypt them. Again, no one else, including us, can read them.

End-to-end encryption and zero-access encryption ensure no cybersecurity attack can target your company emails for corporate secrets or confidential customer information.

Learn how encrypted email works 

Phishing protection

Data breaches can be accidental, but most result from deliberate cybersecurity attacks. Malware and brute force attacks are common methods used for such attacks, but phishing is also a big culprit

As discussed above, Proton Mail includes multiple features designed to combat phishing and keep your data safe. 

Learn more about how to prevent a data breach

To learn how Proton Mail can help protect your business, contact our sales team at enterprise@proton.me.

Final thoughts

Cyberattacks are on the rise, and when implemented as part of a regimen of robust security measures, Proton Mail can be effective at protecting your valuable data from breaches and ensuring your company doesn’t fall victim to phishing attacks. 

Join the Proton ecosystem
Create a free account

Share this page

Related articles

Over 300 billion emails are sent and received daily around the world, making it one of the most popular forms of communication. However, most modern email providers, such as Gmail or Outlook, do not adequately protect your emails.  Gmail stopped rea
Your calendar is more than just a planning tool — it’s a record of your life. It lists what you’ve done, where you’ve been, and who you’ve met. This information deserves the same level of protection as your email and files, which is why we created Pr
Everyone has files that need to be encrypted. From intimate personal details to legal and financial documents, your files contain information that should be private and secure. But many internet services we all use every day are not private. Compani
For years, Apple watched Google and Meta make billions by collecting every scrap of people’s data to target them with ads. Now it appears it was just taking notes. Apple’s advertising operation follows the surveillance capitalism model of its rivals
When we launched Proton Drive two months ago, we wanted to create a truly private and secure cloud storage service. An encrypted cloud that allows anyone on the internet to safely store, access, and share their files without worrying about unauthoriz
From our initial crowdfunding campaign to the recent launch of our encrypted cloud storage service Proton Drive, Proton has always been supported by the community. Your feedback tells us what new features to develop and which we should improve.  For