OpenEFA™ sees what arrives in a person's inbox. EFAidentity, our identity threat detection and response (ITDR) service, sees what happens to that person's account: who signed in, from where, and what they changed. Starting this month, when both see something on the same person at the same time, you get one account-takeover alert instead of two unrelated notes.
Why two halves are not enough
Most account takeovers follow the same arc. Something arrives in the mailbox: a convincing login page, a fake document share, or a flood of mail meant to hide a warning. Then something happens to the account: a sign-in from somewhere new, a reset password, a new MFA method, an inbox rule that hides replies.
An email filter sees only the first half. An identity tool sees only the second. Each half on its own is often ambiguous. A user travels; a user changes their phone; a newsletter has a busy day. Put together on one person, inside one window of time, the same signals stop being ambiguous.
The first link: subscription bombs
The first mail signal we connected is the subscription bomb. An attacker signs a victim's address up to hundreds of newsletters and sign-up forms in a few minutes. The flood is not the attack. It is cover: somewhere in it sits the one message that matters, a password-reset confirmation, a new-sign-in warning or a payment notice, and the attacker is counting on it being lost.
OpenEFA already recognises the flood, keeps it out of the way and warns about it (see Subscription Bomb Protection). What it cannot see from the mail alone is whether the account itself is under attack at the same moment. EFAidentity can.
How it plays out (illustrative)
- OpenEFAA flood of sign-up confirmations starts arriving for one person. OpenEFA identifies it as a subscription bomb and raises a warning.
- EFAidentityMinutes later, the same person's account records a sign-in from a new location and a change to its MFA methods.
- TogetherThe two are combined into a critical account-takeover alert that pages the on-call engineer by text and phone, with the mail evidence and the sign-in evidence side by side.
- EFAidentityAutomatic containment revokes the account's sign-in sessions within seconds, and switches off any inbox rule the attacker planted. The engineer finishes the job with you: password, MFA, and a check of what was sent while the attacker was inside.
Without the link, the same morning would have produced a newsletter warning in one place and a sign-in note in another, each easy to dismiss.
What comes next
The same model is being extended to the other moments where mail and identity meet:
| OpenEFA sees | EFAidentity sees | Together |
|---|---|---|
| Subscription bomb | New sign-in, password reset or MFA change | Live now |
| A phishing message delivered | An unusual sign-in to the recipient's account | Next |
| A quarantined message released by the user | Account or mailbox changes soon after | Next |
| Suspicious outbound mail | An account already under suspicion | Next |
Privacy does not change
Nothing about the link requires anyone to read your mail. OpenEFA shares the fact that a pattern was detected for an address and when; EFAidentity reads sign-ins, settings and audit logs, never message content. The correlation happens on those facts alone, inside the same EFA Security service that already handles your alerts.
What else is new in EFAidentity
- Google Workspace is live alongside Microsoft 365, including 2-Step Verification enrolment per user, not just the policy switch.
- Your own mail server: Zimbra servers are watched through the EFA agent, with the same alerts, correlation and containment as a cloud tenant.
- Automatic containment proven end to end on a live account: a foreign sign-in through a VPN plus an MFA change was tied together as a takeover and the sessions were revoked within seconds.
The full update is on efasecurity.com: EFAidentity November update.
For OpenEFA customers
EFAidentity is a separate service from your OpenEFA plan, and it works without OpenEFA too. If you already have both, the link is on now and there is nothing to configure. If you have OpenEFA only, adding EFAidentity is one administrator consent for Microsoft 365 or Google Workspace, or the agent for your own server, and the onboarding assessment is included. Contact us or read about it on the EFAidentity page.