{"id":18853,"date":"2026-03-03T10:46:37","date_gmt":"2026-03-03T10:46:37","guid":{"rendered":"\/cybersecurity-blog\/?p=18853"},"modified":"2026-03-04T16:23:09","modified_gmt":"2026-03-04T16:23:09","slug":"automatic-ssl-decryption","status":"publish","type":"post","link":"https:\/\/any.run\/cybersecurity-blog\/automatic-ssl-decryption\/","title":{"rendered":"Expanding\u00a0Phishing\u00a0Detection\u00a0at Scale\u00a0with Automatic SSL Decryption"},"content":{"rendered":"\n

90% of modern cyberattacks start with phishing and it\u2019s getting worse. The volume of compromise attempts keeps surging, leaving companies more exposed to credential theft and heavy financial hits. <\/p>\n\n\n\n

As phishing evolves, we focus on countering the core tactics that make it effective. That\u2019s why ANY.RUN<\/a> is upgrading the threat detection capabilities of the Interactive Sandbox<\/a> across all subscription tiers with the<\/strong> new SSL decryption technology<\/strong>. <\/p>\n\n\n\n

By extracting encryption keys directly from process memory, it increases the detection rate of phishing inside the sandbox<\/strong>, helping every user and SOC team in our community to see critical threats early. <\/p>\n\n\n\n

Phishing Pressure Is Rising. Detection Needs to Catch Up <\/h2>\n\n\n\n

Phishing remains the #1 cyber risk for companies, and its scale is intensifying. Gartner predicts<\/a> that AI agents will cut the time required to exploit exposed accounts by 50 percent by 2027. This means that the window for early detection is shrinking. <\/p>\n\n\n\n

A top challenge in identifying modern phishing<\/a> is encrypted HTTPS sessions. Credential harvesting, redirect chains, and token theft often look like normal web traffic. <\/p>\n\n\n

\n
\"Traffic
Traffic encryption prevents SOC teams from detecting phishing<\/em><\/figcaption><\/figure><\/div>\n\n\n

For SOC teams, this means more uncertainty. Alerts require deeper validation. Escalations increase. Investigations take longer. The risk of missing credential compromise rises. <\/p>\n\n\n\n

Encrypted traffic is typically inspected using man-in-the-middle (MITM) interception. While effective in specific scenarios, MITM is resource-intensive and can disrupt realistic analysis. As encryption becomes the default channel for phishing, this approach is no longer enough. <\/p>\n\n\n\n

Detection must work at scale, without slowing confirmation or disrupting execution. <\/p>\n\n\n\n

Scaling Phishing Detection Across Every Investigation with Automatic SSL Decryption <\/h2>\n\n\n\n

To remove one of the biggest obstacles in phishing detection for every ANY.RUN user<\/strong>, the Interactive Sandbox<\/a> now automatically decrypts HTTPS traffic by default, <\/strong>boosting visibility into the most evasive attacks. <\/p>\n\n\n

\n
\"Automatic
Automatic SSL decryption provides a major phishing detection boost in the sandbox<\/em><\/figcaption><\/figure><\/div>\n\n\n

Here\u2019s how it works:  <\/p>\n\n\n\n