Patent ID: 8910279

Claim:
A method for reputation-based threat protection, the method comprising: maintaining information in memory concerning a plurality of identified threats, the maintained information provided by a plurality of preselected sources; intercepting an e-mail message from a sender in an organization and addressed to a destination outside of the organization, wherein the e-mail message is intercepted prior to leaving a communication network of the organization; executing instructions stored in memory, wherein execution of the instructions by a processor: separates the intercepted e-mail message into a plurality of components, searches the maintained information to identify a reputation score associated with each of the plurality of components, determines whether the intercepted e-mail message includes sensitive data as defined by policies of the organization, wherein the determination is based on one or more dictionaries for identifying the sensitive data, and determines that the e-mail message is a threat based on the identified reputation score of each of the plurality of components and whether the e-mail message includes sensitive data; sending information to a designated recipient within the organization regarding the determination that the email message is a threat, the information being sent over the communication network; placing the e-mail message in quarantine for analysis; permitting the designated recipient to review the quarantined e-mail message and information regarding the determination that the e-mail message is a threat; and notifying the sender that the e-mail message was determined to be a threat.