How UHSP Eliminates Phishing Risk with Varonis Interceptor

The University of Health Sciences and Pharmacy (UHSP) is a 160-year-old institution focused on healthcare education and research, graduating hundreds of students each year into careers in pharmacy, biomedical sciences, and public health. Like many universities, UHSP operates a highly open, distributed environment with a large and constantly changing student and faculty population — making it an attractive target for phishing, especially as attackers increasingly turn to AI-driven social engineering to exploit trusted academic communications.

In 2023, UHSP experienced a ransomware attack that reshaped how the organization, and CIO & CISO Zachary Lewis, approached security — particularly visibility into sensitive data and threat detection. Lewis documented the experience in his book, Locked Up, and came to understand that addressing phishing and social engineering was critical to protecting the university's sensitive data from exposure and unauthorized access.

CHALLENGE

Stopping Phishing Attacks in an AI-Driven Threat Landscape

Despite having a traditional secure email gateway in place, UHSP's security team was consistently dealing with phishing attacks targeting large portions of the university's population at once. The result was constant disruption — repetitive, time-consuming incident-response workflows and custom scripts just to keep up with remediation. As attackers began using AI, the attacks grew more targeted, more convincing, and more sophisticated. UHSP needed a solution that could identify and block phishing emails before they ever reached users, removing the burden of incident response altogether.

SOLUTION

Stopping Phishing and Social Engineering Before It Reaches Users

UHSP deployed Varonis Interceptor to reduce phishing risk and operational overhead, and the impact was near-immediate following a short proof of value.

We ran it in our environment for a month, and nothing got through. When you're getting two a week and then none, that's a pretty good indicator.

What had been a steady stream of phishing emails reaching users was effectively brought to a halt, with threats consistently blocked before reaching inboxes — dropping from a persistent weekly occurrence to near zero over the following three years. Interceptor gave UHSP detection of phishing and advanced email threats with 99% accuracy, identification of malicious links, domains, and behaviors through AI analysis, automatic remediation with no manual intervention, and continuous adaptation to new attack techniques.

Detecting AI-Powered and Zero-Day Phishing Attacks

Interceptor detected sophisticated threats like token replay attacks and calendar-invite-based phishing, helping UHSP stay ahead of advanced and zero-day attempts powered by AI.

It's harder now than it's ever been to detect phishing emails because of AI. These emails are very cultivated and more targeted now. There aren't the same indicators we used to look for and train people to recognize. Having a tool like Interceptor is more critical than ever.

Interceptor continuously adapts to evolving threats — including session hijacking, malicious calendar invites, QR code phishing, and advanced social engineering — without manual intervention. Implementation itself took only minutes to deploy, with minimal ongoing management required.

RESULTS

Near-Elimination of Phishing Reaching Users

With Interceptor in place, phishing attacks were virtually eliminated across UHSP's environment. The shift transformed how the security team operates: manual triage and remediation workflows were largely eliminated, freeing time and resources previously consumed by constant response efforts. It also significantly reduced the university's human risk, since users are now exposed to nearly no malicious email and no longer need to make real-time judgment calls about what's safe — allowing UHSP to scale back the frequency of its security awareness training, even as that training remains an important layer of defense.

As phishing exposure decreased and confidence in detection grew, UHSP came to rely on Interceptor to take immediate action, confidently hard-deleting and purging malicious emails from the environment. By controlling one of the most common paths attackers use to compromise accounts and access sensitive data, Interceptor has strengthened UHSP's broader data security and governance efforts.