How can a cybersecurity company safely send malicious files to clients for testing purposes without being blocked?

Email marketer from Reddit suggests ensuring that recipients are fully aware of the testing and the nature of the files they may receive. Clear communication is key, manage expectations. They suggest informing recipients before sending to them and giving a heads up to the internal security teams.

Email marketer from Email Geeks shares experience with an AV vendor client, who had a pre-req doc for bypassing filtering for phishing tests and spun up a new Azure IP for each client for virus/malicious file testing, with Microsoft being aware of their activities.

Email marketer from StackExchange suggests talking to the clients IT security team and making them aware of the pen test or security testing you are conducting for the company. It is important to ensure that any real attacks can be stopped and this gives a good indication of the companies overall security strength.

Email marketer from StackExchange responds with the suggestion to request clients to whitelist specific IP addresses used for penetration testing and simulated attacks. This would allow the testing emails, including those with malicious payloads, to bypass security filters.

Email marketer from Cybersecurity Community Forum suggests setting up separate test email accounts on a different domain. The accounts should be dedicated to sending the test emails and use a different IP range than the standard company communications. This should limit any damage done to the companies domain.

Email marketer from Reddit says to reach out and try and get approval to send through the security vendor of the client. This can be time consuming but allows the test to go through as expected and get a more reliable outcome of the companies security strength. They should be informed about the test and the exact nature of the files sent to them.

Email marketer from InfoSec Institute explains the importance of clear contractual agreements. These agreements will outline the scope, methods, and responsibilities related to sending potentially harmful content to clients for testing. This is to ensure proper authorization and mitigate potential legal issues.

Email marketer from LinkedIn explains the importance of using a separate domain for sending test emails, especially those containing potentially malicious content, to avoid damaging the reputation of your primary domain.

Email marketer from Email Geeks mentions their A/S engine tweaks to allow suspect content through for vetted security vendors doing phishing testing, suggesting spinning up an EC2 or Azure instance for the described use case.

Email marketer from Security Forums suggests sending the potentially malicious files to a sandbox environment for analysis before sending them directly to clients. This can help verify the malicious nature of the file and ensure it's handled safely by the recipient's security systems.

Email marketer from Cybersecurity Blog mentions using encrypted archives (e.g., password-protected ZIP files) to deliver the files. This may bypass some basic email security filters, but it requires the client to have the password and understand the risks.

Expert from Spam Resource, Laura Atkins, emphasizes the need to protect sender reputation when conducting security tests, highlighting the risk of damaging legitimate email streams. It is important to plan your testing to avoid affecting your sender reputation.

Expert from Email Geeks suggests sending malicious files from a throw away domain and possibly a VPS somewhere for cybersecurity testing.

Expert from Word to the Wise suggests building a relationship with different anti-spam vendors/services. If they know what your testing criteria is for specific clients, they may be more lenient in the blocking of emails to allow you to conduct your tests and get a better idea of security levels. They also indicate that if you do affect your sending reputation it may affect future email delivery.

Documentation from Microsoft Learn explains that Microsoft 365 offers advanced delivery policies to allow simulated phishing attacks for training purposes to bypass filters. These policies require configuration to identify the sending IP addresses and domains used for the simulations, ensuring legitimate tests are delivered while maintaining overall security.

Documentation from NIST provides guidelines for vulnerability testing, including considerations for safely handling potentially harmful content. It includes recommendations on obtaining proper authorization, implementing containment strategies, and adhering to ethical testing practices.

Documentation from NCSC details guidance on conducting penetration testing, which includes considerations for safely handling and delivering potentially malicious payloads. It emphasizes the need for explicit agreements, controlled environments, and clear communication with the client.

Documentation from AWS describes the use of EC2 instances for sending emails, which can be configured to bypass some filtering mechanisms. However, they emphasize the importance of adhering to AWS's acceptable use policy and obtaining necessary permissions before sending any potentially harmful content.