Cofense Triage vs. Recorded Future Intelligence Cloud

The tool is very helpful in improving Phishing detection capabilities as it streamlines the process of analyzing user reports a lot. Besides it has a built-in mechanism of rating reporters(end-users) based on their historical performance. Downside - tool requires continuous resource investment to deliver best result. Tool is not helping too much in improving user-education, because automated response process is not immediate and is prone to errors

Incentivized

If you want a platform that is covering thousands of sources, and that includes deep, dark web, clear web forums, blogs, newspapers, social media networks, etc. Recorded Future is the most complete solution that I have seen. On the other hand, if you are looking for a really advanced platform with lot of human added value, research papers, advanced investigations, etc. Recorded Future might not be the ideal solution.

Incentivized

• Separating links and attachments contained in the email, and checking to see if they are known malicious.
• Clustering like emails to save time when responding.
• Providing risks scores with each cluster to give an estimate on which clusters should be addressed first.

Incentivized

• Gives latest threat reports regarding an artifact (IP, domain or hash).
• Browser extension provides a real-time information about an artifact.
• Accurate in identifying malicious domains and IPs.

Incentivized

• There are too many interdependent pieces which you have to acquire separately.
• I think Cofense has a lot of capabilities and usefulness, but I think it's too a la carte.
• We own Cofense and PhishMe currently and there are some gaping holes that require additional licensing to close.

Incentivized

• E-Mail reports can show unrelated content, especially sometimes you'll see alerts popping up for articles which have been published years ago but for some reason were just recently discovered by RF.
• Yara rules from their insikt blog sometimes are not syntactically correct and need to be manually edited to actually work. There's some proper QA missing.
• Their global and 3rd party risk reports could be more tailored towards the industries of their client. There is entries for totally unrelated security incidents. Of course a global list aims to find incidents on a global view, but it doesn't add much value at that point.

Incentivized

Cofense is stable and provides easy to use solution to aid the investigation of emails as well as managing simulated phishing campaigns.

Incentivized

The interface is easy and intuitive.

Incentivized

We've experienced zero downtime.

Incentivized

No slowness seen.

Incentivized

I've had an issue with their browser-plugin which didn't want to authenticate correctly. RF's support could arrange for a session with me and identify and solve the issue. I was very pleased how serious they took my problems and also how knowledgeable they are.

If I have more general questions they quickly reply and most likely also have a solution at hand.

Incentivized

Training was through, relevant and easy to follow.

Incentivized

The other product had a lot of fails on the auto-processing and did not integrate well with our current environment. One issue had to do with the way it sends the submissions to its processing engine—our email gateway configuration would have blocked this traffic. I also did not like the user interface.

Incentivized

It is the most complete solution of these three, as the others are focused in specific areas and having really detailed analysis about threat actors, APT groups, etc. Recorded Future is not having this level of knowledge in really specific areas but doing a really good work covering thousands of sources and the most relevant forums.

Incentivized

We've experienced zero downtime

Incentivized

• Due to the integration potential, large amounts of time are saved on a daily basis.
• Incident response time has dropped due to the increased information available by having access to phishing emails directly.
• Staff are able to effectively learn how multiple tools in our environment are used by mastering Triage. This has decreased training time greatly and increased the effectiveness of each associate.

Incentivized

• Recorded Future crashes my web browser in cases I have to open a web page containing hundreds of IPs. A quick disable feature for a particular tab would be beneficial for someone like me.

Incentivized