Update: Need advice to protect on-prem Windows Servers and a mix of mac/win from phishing

Update to a previous thread:
Same user was phished twice. Supposedly they don't like talking to the vendor in question and just follow whatever emails say. In both cases the phisher took them to a look alike banking site that allowed them to wire to a 'new' account that was actually overseas somewhere. This is going to take user education definitely, but what would be the best product to stop these types of emails?
They have 15 users, 6 on macs and the rest on Win11. Everyone is a local admin. My recommendation is that should no longer be and also USB should be locked down to non-storage devices only.
They run their own window servers on-prem and have no cloud. I still am waiting to find out the level of M365 they have especially since they are a non/not for profit organization. The are using O365 for email.
They are using WebRoot and MalwareBytes as security tools.
They did get MFA turned on for all users and Microsoft reviewed all email accounts for any malicious rules. They did not find any that I am aware of.
I agree they need something like AppRiver / Abnormal at the minimum and also user education as well. The MSP uses AppRiver already for customers that want it, however; I did not get one recommendation for that product in this hunt. Abnormal did come up almost 100% across the board though.
Any thoughts on the best approach. One of the issues company's like Abnormal have a minimum $25k contract per year regardless of user base. For this company it means they are paying for a little more than twice the users they have.

​

Thanks submitted by /u/TheRealAlkemyst
[link] [comments]


http://dlvr.it/T0GS5C