TECHNICAL FIELD

Various embodiments concern computer programs and associated computer-implemented techniques for generating and then managing databases that can be used to ascertain the risk in interacting with entities over email.

BACKGROUND

Email has become vastly more sophisticated with the Internet connecting millions of individuals in real time. These advancements in connectivity have incentivized cyber actors (also referred to as “attackers”) to send malicious emails in greater numbers than ever before. Because email represents the primary communication channel for most enterprises (also referred to as “companies” or “organizations”), it is a primary point of entry for attackers.

Historically, enterprises employed secure email gateways to protect on-premises email. A secure email gateway is a mechanism—implemented in hardware or software—that monitors inbound and outbound emails to prevent the transmission of unwanted emails. However, such an approach is largely unsuitable for examining the vast number of emails handled by collaboration suites such as Microsoft Office 365® and Google Workspace™. For that reason, enterprises have begun employing security operations center (SOC) analysts who use various security products to inhibit and/or handle email scams. Examples of email scams include phishing campaigns and business email compromise (BEC) campaigns. As an example, some enterprises define, prioritize, and respond to incidents through an approach referred to as mail-focused Security Orchestration, Automation, and Response (M-SOAR).

