Cisco Umbrella inspects every DNS request made by EHF's 26 devices, around the clock, and blocks the ones headed to known-malicious destinations before a connection is ever established. This quarter it intercepted 9 such attempts across 4 devices, most of them in August. Each one is a threat that never reached a device or an inbox, which is part of why the device layer had so little to catch.

Every assigned EHF device runs CrowdStrike Falcon, which combines automated detection with OverWatch, a team of human threat hunters who reviewed 284 events across EHF's devices in the past week alone. The quarter's single detection was a potentially unwanted browser extension bundled with a free utility download. Falcon quarantined it on arrival, Cascade confirmed nothing else was affected, and no further action was needed. No threat executed on any device this quarter.

All 34 monitored mailboxes remained fully protected, with zero unprotected recipients. The 3 messages released from quarantine were legitimate vendor invoices, confirmed by Cascade before release. Nearly all malicious mail was stopped before an employee ever saw it.

The people who use EHF's systems are the last line of defense for anything that reaches an inbox or a browser. Cascade runs a reminder campaign for anyone who misses the initial training, and 3 employees completed the course this quarter after a reminder. Cascade is following up directly with the 2 employees named above to bring completion to 100% before next quarter. Simulated phishing results, a second measure of this same layer, are on the following page.