University of Surrey Strengthens Email Security with Varonis Interceptor

The University of Surrey is a research-focused university with nearly 30,000 users, depending on open collaboration across students, staff, affiliates, research communities, and external and commercial partners. That openness supports teaching and discovery, but it also creates a noisy email environment where legitimate messages often arrive from unfamiliar senders — making phishing harder to spot. For Thomas Brown, Head of Cyber Operations, the goal was strengthening security without limiting the collaboration the university depends on.

That balance became urgent after six university accounts were compromised and used to send roughly 10,000 emails each within seconds — a stark demonstration of how quickly a trusted internal account can be weaponized at scale.

CHALLENGE

Detecting Sophisticated Email Threats Without Disrupting Collaboration

Surrey already had layered Microsoft email protection in place through Exchange Online Protection, Microsoft Defender, and phishing and malware policies. Still, the security team identified a gap: plain-text phishing emails sent through trusted consumer email services could evade traditional defenses, since they lacked the malicious links or attachments those defenses were built to catch.

The university's challenges centered on detecting plain-text phishing without links or attachments, distinguishing malicious activity from legitimate academic collaboration, reducing the impact of compromised accounts, and minimizing manual triage time for a busy security team.

Separating Malicious Intent from Everyday Spam

Surrey's academic environment also generated significant graymail — unfamiliar senders, mailing lists, and promotional offers tied to university addresses — making it risky to apply broad sender or domain blocks without disrupting legitimate academic work.

SOLUTION

Rapid Implementation with Immediate Value

The university evaluated Interceptor through a proof of concept, which quickly surfaced the composition of its email traffic and confirmed the protection gap the team had identified. The technical deployment required minimal changes to existing infrastructure, with no new gateway placement or major mail-routing changes needed.

Interceptor just plugs into our existing infrastructure, which is a huge plus.

Behavioral Context, Relationship Intelligence, and Automated Remediation

After a successful proof of concept, Surrey deployed Varonis Interceptor for approximately 3,600 staff members, while evaluating broader deployment across students and affiliates. Interceptor examines factors traditional tools can't easily evaluate — communication patterns, message language, and whether a sender and recipient have an established relationship — giving the security team relationship-aware analysis, behavioral and linguistic context, detection of sophisticated plain-text phishing, automated removal of unwanted messages, and faster analyst decision-making, all alongside Surrey's existing Microsoft controls.

RESULTS

Improved Efficiency and Investigation

With Interceptor in place, Surrey has reduced graymail and malicious messages reaching users, improved visibility into suspicious communications and relationships, and strengthened its defense-in-depth alongside Microsoft's controls — protecting roughly 3,600 staff accounts and mailboxes.

One of the most valuable outcomes has been the time saved on investigation. Previously, messages that landed in junk folders created extra work whenever users retrieved and reported them as phishing, requiring manual review and validation. With Interceptor automatically removing confirmed spam and unwanted messages, those repetitive investigations have largely disappeared, freeing the security team to focus on higher-priority threats.