You are double the price of knowbe4. How do you expect to possibly compete?
The pricing is a work in progress.
Launch HN: Riot (YC W20) – Phishing training for your team
81–90 of 93 posts
Re: Launch HN: Riot (YC W20) – Phishing training for your team
#82The copy in your post is great. I understood what you do straight away.
Thanks!
Re: Launch HN: Riot (YC W20) – Phishing training for your team
#83The only time that a phishing attempt actually worked for our company (afaik) occurred when someone emailed an executive in our company (ugh) with a docusign looking email with content that he was EXPECTING. it redirected him to a fake Active Directory sign in link that he fell for. Immediately after entering his password his outlook spammed his entire contact list with the same phish except addressed to them specifi…
I had this exact same attack in my previous company, and it spread quite rapidly.
Re: Launch HN: Riot (YC W20) – Phishing training for your team
#84> "I was pissed" How do you balance/deal with "security shaming", which is proven to put you further at risk as an organization? There is some interesting research from the UK Government in this space - https://www.ncsc.gov.uk/blog-post/trouble-phishing#section_3 The relevant bit: "If just one user reports a phish, you can get a head start on defending your company against that phishing campaign and every spotted ema…
>How do you balance/deal with "security shaming", which is proven to put you further at risk as an organization?
I've had this happen to me, not for phishing, but for the kensington lock thing. Probably not that common any more, at least not in the west, but some workplaces have aggressive laptop locking policies. Workplace tried this stunt of confiscating laptops that were not locked, and everyone had to meet some manager type person. It was completely asinine. This is a typical badge access controlled workplace with additional security personnel. The laptop locks were a total overkill.
Re: Launch HN: Riot (YC W20) – Phishing training for your team
#85Seems to be a hot topic recently. I first discovered https://www.hoxhunt.com/ , there are probably some other competitors as well, what makes you different?
I would be interesting in this answer as well. There is actually quite heave competition in this space: PhishMe, PhishLabs, IronScales, MediaPro, KnowBe4, Wombat (acquired by ProofPoint). What convinced YC to invest in your company?
Not OP, but I will say, of those companies, only two or so really focus on this as the market is incredibly saturated. For example, Attack Simulator via Microsoft was recently announced, and their O365 brand is one of the most abused. Most have acquired other organizations to find higher ground.
Re: Launch HN: Riot (YC W20) – Phishing training for your team
#86I always thought the point of fire drills was to inure people to them so that in case of an emergency they would just blasély treat it like a drill instead of panicking: you want them to treat a real positive like a false positive.
Injecting false positives generally can impair quality and whether or not quality will be impaired or improved with false positives is really context dependent. Indeed, low false positive rates are often used as a measure of quality, so in generally you don't want to increase them carelessly.
In the case of things like phishing training, I imagine (but I could be wrong) that the injection of false positives just causes the people who recognize phishing emails to ignore them instead of reporting them: there is too much noise and too little signal. The people who don't recognize them will continue to fall victim. In that case, inuring the knowledgeable seems detrimental since you lose the likelihood of receiving a report.
I follow inbox zero practices and routinely delete all my email. Since forwarding a phishing email to security is a lot more complicated then hitting the delete key (like I probably just did for another email) I'm personally most likely to delete phishing emails unless I am getting them very rarely or it seems especially pernicious. Indeed, most of the phishing emails I receive lack a certain phishy feeling (like lacking a DKIM signature or other weird mail header shenanigans). I generally just assume they are these sorts of false positives.
Re: Launch HN: Riot (YC W20) – Phishing training for your team
#87> Would love to hear your war stories on phishing scams, and how you train your teams! I was working on anti-phishing in 2003, before it had the name phishing. We were trying to teach our users not to fall for the scams. It didn't work. People will fall for the same scam over and over. The conclusion we came to was that the only solution to phishing was education, and education was also nearly impossible to get 100%…
> We've been trying to educate people about phishing for 17+ years. :)
Well that is 17 years Riot could've charged your company $199 per month. Similar to dating websites, not achieving the customer's goal is good for Riot's business.
Re: Launch HN: Riot (YC W20) – Phishing training for your team
#88This is a hot area, but there are already huge competitors. How do you differentiate?
Great question! 1. From Gophish: you need to be technical and you need at least a week off to prepare the attacks. With Riot, you can be sending attacks in a matter of minutes. 2. From Knowbe4, …: those are products made for enterprise companies, that are trying somehow to adapt to smaller companies. Riot is doing the opposite: it was built with smaller companies in mind. Overall, I think there's a huge need today fo…
So, to summarize, it's phishing training for small companies. Makes sense.
Re: Launch HN: Riot (YC W20) – Phishing training for your team
#89I invented this space. Ask me anything.
Aaron Higbee
Re: Launch HN: Riot (YC W20) – Phishing training for your team
#90Great idea, just some copywriting fixes:
1. "runs the latest scams techniques on your team" should be "runs the latest scam techniques on your team"
2. "trainings" while technically a word, native English speakers will find it odd as you rarely see it used. use "training" instead, ex: "We get it: trainings are annoying" to "We get it: training is annoying"
3. "Riot offers an interactive, tailor-made 5-minutes training your employees will actually enjoy and learn from." to "Riot offers an interactive, tailor-made, 5-minute training your employees will actually enjoy and learn from."
4. "Riot will perform attacks and trainings on your team" to "Riot will perform attacks and training for your team"