Barracuda Total Email Protection's Reporting Buttons - What Am I Missing?
We recently stopped using KnowBe4 and upgraded from Barracuda's Cloud email filtering to the Total Email Protection package. Sales swore up and down it worked just like KnowBe4. It does not and the report button thing is very bad. I really hope there's a key piece missing here, please fill in the blanks where my logic and their support department has a gap:
The interactive email security part of TEP is called Forensics & incident response. There is a barracuda essentials button that reports back to the main message log and to Forensics when a user reports a message. The phish testing portion of TEP is Phishline and appears to be a completely separate product that's been bought and rebranded. Phishline has its own Phish/SPAM report button that only reports to Phishline. Worse, those reports aren't available for up to 1 week after a phishing campaign.
So, with regard to the Outlook plugin buttons, I have 3 options
-
Use the Barracuda Essentials button only. This data will never make it back to Phishline so users will never get credit for properly identifying a phish. With KnowBe4 I was able to demonstrate a click rate drop from 35% to 5.8% over 1 year and show those users are actively reporting malicious messages vs. simply ignoring their email. Email ignoring is an issue here so it's been really helpful to prove users are identifying and reporting.
-
Use the Phishline button only. This data will never make it back to Forensics. It only goes to Phishline and is only available up to 1 week after a phishing campaign completes. We can see reported emails after the week of waiting, even if they're legitimate phishing messages, but there's no way to know about active security threats.
-
Use both buttons. Teach users to click the Phishline button when they think they're being tested and click a different button when it's a real threat. hahahahhahahahahhahahahahahhahahahahhahahahahahhahahahahhahahahhahahahhahahahhahahahhahahhahahhahahhahahhaahahahahahhahahahhahahahhahahahhahahahahahhahahahahha
Barracuda cannot reasonably expect us to have data in only a single system or actively run 2 different email reporting buttons. That's absurd. What am I missing?
Posted Jul 16, 2021, 9:16 PM UTC
Don’t trust sales. Always ask for Q&A demo with a software engineer. Ask all the questions.
Sorry, I don’t have anything for your current situation.