CERN's email security challenge

The organization recently decided to move its email infrastructure to the cloud. Having a culture of "bring your own device", CERN must secure email and web traffic before it reaches the endpoint. That became increasingly difficult as people were receiving more and more sophisticated threats.

For CERN and other organizations, the potential damages of a successful attack are severe and vary from operational interruptions and data breaches to misuse of the organization’s 150+ data centers. 

During the migration project, the Computer Security team identified several gaps related to fighting modern email attacks such as phishing and decided to look for additional solutions.

The xorlab solution

In 2023, CERN integrated the xorlab Email Security Platform seamlessly with their cloud email service. The API-like inline deployment allowed CERN to keep the MX configuration untouched and to perform threat analysis before emails get delivered to the inbox. xorlab's AI-powered solution analyzes email messages based on context and behavior, filtering out phishing, business email compromise, and malware attacks and eliminating any possibility of engagement by the user.

The solution also provides end-users with an intuitive way to manage their quarantine and get actionable insights into why emails were filtered. "We are using xorlab also as a platform to train our users. When logging in, people see why an email has been quarantined and why the security team believes that this is a malicious email. With this information, people are empowered to reconsider whether they would like to release the email themselves" - says Stefan Lüders, Computer Security Officer.

Why CERN chose xorlab email security

Before engaging in a contract, CERN conducted a Proof of Concept (PoC). In it, the Computer Security team compared the detection capabilities of two shortlisted solutions with one another: xorlab and a Gartner-recognized industry leader.

In this Proof of Concept, both solutions analyzed the same email volume and labeled each message with their verdict. xorlab detected 4 times more threats than the competing solution and demonstrated higher accuracy with a false positive rate of only 0.06%. 

The significantly better detection due to xorlab's unique approach, a low false positive rate, and the ability to integrate end-users into daily quarantine management convinced the team to engage with xorlab as their partner for email security.

xorlab's security ROI

The risk of getting attacked via email is dramatically lower since deploying xorlab. In the past 3 months (Feb-Apr 2024), the Computer Security team at CERN stopped a total 643'515 email threats, including 82'553 phishing attacks, 1'532 business email compromise (BEC), and fraud attempts. Of the 82'553 phishing attacks, 67'223 were so called zero-hour threats, meaning their indicators of attack (sender addresses, sender domain and IP, link domain, etc.) were unknown at the time of delivery.

The time saved by providing better and more intuitive self-service to end users is only starting to become visible.

With xorlab, CERN has a robust email security solution that protects its 18 000 employees and researchers from advanced email attacks and lets them focus their full attention on pioneering research into the mysteries of our universe.