# Cyber security | Eightstep > Email security, endpoint detection and response, application control, awareness training and password management, set up, tuned and looked after for you. Source: https://eightstep.com.au/cyber-security # Cyber security **Every inbox, device and person, protected** Email security, endpoint detection and response, application control, awareness training and password management, each set up, tuned and looked after by us, so your people can work with confidence. [Get started](https://eightstep.com.au/contact) [See how it works](https://eightstep.com.au/cyber-security#email) ## Trusted by Australian organisations ## Email security ### Checked before the inbox Every email is checked inside Microsoft 365 before it's delivered, so phishing, impersonation and harmful files are stopped before anyone sees them, with no change to how your email works. ### Links checked when clicked Each link is opened safely first, and harmful pages are blocked, including links inside PDFs and Word documents. ### Attachments made safe Risky files are cleaned and delivered in seconds, and password-protected files are opened and checked before they arrive. ### Teams, OneDrive and SharePoint too Links and files shared in Teams, OneDrive and SharePoint are checked the same way as email. ### Gone from every inbox When a phishing campaign is found, every copy can be removed from every inbox at once, along with any that follow. ### Unusual activity flagged Suspicious account activity, such as sign-ins from unexpected countries or new forwarding rules, is flagged for action. ### Sensitive data kept in Emails carrying sensitive information, such as card or personal details, can be blocked or encrypted before they leave. ## Endpoint detection and response ### Threats stopped on every device Every computer and server watches for harmful behaviour as it happens, stopping ransomware and new kinds of attack on its own, then undoing the damage. ### Protection on the device Detection runs on each computer and server itself, so threats are stopped in moments, even when the device is offline. ### Ready for the unknown It watches what programs do, not only what they are, so new ransomware and attacks that leave no file behind are stopped too. ### Ransomware rolled back On Windows, files changed by ransomware can be put back as they were, in a few clicks. ### The whole story Every step of an attack is linked together automatically, so it's clear where it started, what it touched and that it's gone. ### Isolated in one click An affected device can be cut off from the network while it's dealt with, and reconnected once it's clean. ### Every device covered Windows, Mac and Linux computers and servers, protected the same way and managed from one place. ## Application control ### Only approved software runs Everything else is blocked by default, so unknown programs and scripts can't run on your computers and servers, and the software you trust can't be turned against you. ### Learns before it locks It starts in learning mode, recording what you already use, and we build policies around it before anything is blocked. ### Limits for every app Approved apps are kept to what they need, such as which files they can open and where they can connect. ### Simple requests When someone needs new software, they ask the service desk. We pass it to your approvers with what they need to decide. ### Microsoft's block rules Microsoft's recommended block rules applied to your computers and servers, and kept current as Microsoft updates them. ### A record of every decision Allowed and blocked activity is logged in a record that can't be altered, with reporting access for your nominated people. ### Reviewed every year Once a year we go through every policy with you, to decide what stays, what goes and what's new. ## Awareness training ### People who spot the signs Realistic phishing simulations and short lessons, tuned to each person, so your team gets better at recognising a scam over time. ### Simulations that adapt Each person's simulations get harder as they improve and simpler when they slip, so everyone keeps learning. ### Close to the real thing Simulations use local brands and familiar formats, and can appear to come from colleagues, just as real attacks do. ### A lesson in the moment Anyone who clicks sees exactly what they missed and how to spot it next time. ### Training in minutes Short, interactive lessons delivered automatically, built for every kind of learner. ### One-click reporting People report suspicious email straight from Outlook. We review every report and tell them when it's a threat. ### Quarterly benchmarks Every quarter we test the whole company the same way, then walk you through the results. ## Password management ### A strong password for everything A secure vault for every person that creates, stores and fills in passwords on every device, so nobody has to remember them or reuse them. ### Encrypted on the device Passwords are encrypted before they leave each device, so no one else can read them, including us. ### Shared safely Share logins with a team or a person, without sending passwords by email or chat. ### On every device Apps for computers and phones, and in the browser, so the right password is always to hand. ### Your Microsoft sign-in It can connect to the Microsoft account your people already use, so there's one less thing to remember. ### Control for admins Set password rules, see who can reach what, and remove access the moment someone leaves. ### See where you stand Reporting across the business shows who has access to what, and where to focus. ## Looked after all year Security keeps working when someone keeps working on it, so we tune it, review it and report on it all year. 300+ signals checked on every email before it reaches an inbox Level 3 the Essential Eight maturity our application control is built to reach, the highest Every email your people report, reviewed by our security team 4 company-wide phishing benchmarks a year, talked through with you ## Switched on without the disruption Each layer watches before it blocks, so protection fits the way you already work. Step 1 ### Plan We agree which layers you need, who approves new software, and how each layer should behave. Step 2 ### Learn Email security starts in monitor mode and application control in learning mode, while your people sit a first phishing benchmark. Step 3 ### Tune We go through what each layer found with you, and shape the policies around the way you work. Step 4 ### Protect Full protection switches on a group at a time, and we keep managing it from there. ## Works well with Services that round out your security. ### [Essential 8](https://eightstep.com.au/essential-8) See how your environment lines up with the ACSC Essential Eight. ### [Backup and disaster recovery](https://eightstep.com.au/backup-and-disaster-recovery) Backed up, checked every day and ready to restore. ### [Microsoft 365 backup](https://eightstep.com.au/microsoft-365-backup) Email, files and Teams, backed up and easy to restore. ## Questions, answered Anything else? [Ask us directly](https://eightstep.com.au/contact). **How is it priced?** Each layer is priced per person or per device, per month, so it grows and shrinks with your team. Setting up a layer is a one-off project, quoted before we start. **Do we need every layer?** No. Each layer stands on its own, and we'll recommend where to start. They work best together, because each one covers what the others can't. **Will it get in the way of our work?** Each layer is tuned to the way you work before it starts blocking. When someone needs new software, they ask the service desk and your approvers decide. **Does email security change our email setup?** No. It connects to Microsoft 365 directly, with no change to your mail records, and checks email inside Microsoft 365 before it's delivered. **How does it help with the Essential Eight?** Application control is one of the Essential Eight strategies, and our service is built to reach maturity level 3 for it, the highest level. See how the rest of your environment lines up with [Essential 8](https://eightstep.com.au/essential-8). **Where is our data kept?** Email security data is kept in Australia. Password vaults are encrypted on each device before they're stored, so only your people can read them. **How does it fit with Managed IT Services?** Managed IT Services already covers the essentials, such as patching, anti-virus and sign-in auditing. Endpoint detection and response, email security, application control and awareness training go further, and we include them in every [Managed IT Services](https://eightstep.com.au/it-services) quote by default.