How does VIP impersonation actually work? Can you add custom names?

Question

We've been having a...challenging interaction with a Sophos support staffer who says that the VIP impersonation feature does not check display names, only email addresses. This doesn't make sense, so I'm hoping the community can confirm this is not true. Additionally, assuming VIP impersonation checks display names (as all other impersonation products I've used do), is there a way to add custom names for comparison? 
 As an example, we have several 'Jennifer' staff and receive phishing attempts with the same display name shortened to 'Jen', and I'd like to manually add common nicknames as VIP impersonation criteria. 
 Thanks!

Santosh Barnwal · Accepted Answer

Hi TG1 
 The VIP impersonation does check the display names. If you can please share the case id, I would go back and fix my support string wherever it's loose. 
 The detection is based on VIP name match in conjunction with an array of machine-learning algorithms and anti-phishing heuristics, including variations of the names. At present, you do not get the option to add custom names. Our engine already considers common variations of the names to adjust the score. However, our algorithm may not have the complete list of variations in names, and it learns new ones as we receive feedback from customers and partners. 
 Hope this helps.

How does VIP impersonation actually work? Can you add custom names?

Top Replies