<i>Case Study:</i> How Mesa Systems Resolved Its Phishing Issues

Established in 1981, Mesa Systems, Inc. is a full-service provider of residential, commercial, and logistics-based mobility solutions for businesses and individuals. We have helped many of the world's largest, most respected corporations move their employees, offices, and industrial facilities domestically and internationally.

As Director of IT, it is my responsibility to support over 150 transportation management specialists and relocation customer care professionals across multiple locations in the U.S. In my years of experience, I've come to understand that phishing is a constantly changing landscape, which requires my unwavering attention and focus.

Pain Point

We have noticed that email attacks come in waves; we receive approximately 10 phishing emails each week. Every company gets spam and other unsophisticated phishing attacks, which are obviously malicious (e.g., bad grammar, etc.). These are easy to detect and avoid for most employees. The challenge lies in the less obvious, difficult to detect and clever messages that can easily escape the untrained eye. This, coupled with a link or attachment directing them to take the wrong action, can cause catastrophe. Because I know the potential risk to the company if an employee were to take the bait, I treat each phishing email seriously.

The Problem

Initially, we rolled out a security awareness and training program that required me to customize content and take the necessary time and effort to monitor and train the employees — to teach everyone how to spot emails that might not be legit and report them. While the training increased overall awareness and guided more cautious behavior — which is a good thing — it also created additional work for me. Even with extensive training of my employees, I was still getting an exorbitant amount of questions such as, “Can I open this? What about this? How about this?” Investigating possible phishing emails has been a manual process, which required us to look into each email, verify if it was legitimate and then reply back to the employee with the outcome and instructions.