Enterprise electronic mail compromise (BEC) continues to be thriving even in organizations which have applied multi-factor authentication (MFA). As security professionals, we frequently assume that MFA is the silver bullet for electronic mail security, however real-world incidents counsel in any other case. Attackers exploit human behaviors, course of gaps and operational blind spots that MFA alone can’t tackle. In lots of fashionable BEC instances, no account is technically compromised in any respect, which locations these assaults outdoors the safety boundary of MFA controls.
In 2019, Toyota Boshoku Company fell to a BEC assault with an worker transferring over $30m to scammers following a cloned electronic mail from a 3rd celebration firm with urgency citing the necessity for the transaction to be accomplished urgently in order to not decelerate Toyota’s manufacturing line. There was no indication that the Toyota worker’s electronic mail had been compromised. Take additionally the 2024 case of Arup the place attackers impersonated a senior supervisor utilizing Deepfake voices and movies and satisfied a member of the finance workforce to make funds totaling $25m. The compromise didn’t depend on stolen credentials however on fastidiously orchestrated social engineering, timing and the finance workforce’s procedural shortcuts. The technical safeguards may have been sturdy, however human oversight proved to be the weakest hyperlink. In each instances, the failure occurred on the determination level, not on the authentication layer, exploiting belief, timing and established, handy, approval habits.
The place security controls finish and enterprise danger begins
From expertise, this situation is all too frequent. Organizations usually give attention to deploying security expertise with out addressing human workflows and tradition. This usually contains shiny new EDR expertise that are used to examine packing containers for audit and compliance functions, and which CIOs are fast to log off on to point out stakeholders they’re cyber resilient. This isn’t a failure of EDR itself, however of how security investments are scoped. Endpoint and identification controls shield methods, however they don’t govern how monetary approvals, vendor adjustments or government requests are validated in apply.
MFA reduces danger however can’t exchange the necessity for course of controls, verification routines and steady consciousness coaching particularly as there at the moment are AITM phishing kits which bypass MFA within the wild. The operational blind spots being exploited sit in enterprise workflows the place velocity, belief and authority override verification, significantly in finance and procurement processes.
These blind spots exist as a result of enterprise processes are optimized for velocity and continuity, not verification. Finance groups are skilled to maintain operational traces transferring, and attackers who’ve now taken cognizance of this, use this benefit to their very own benefit by introducing urgency or invoking authority. When a request seems official, time-sensitive and from somebody with perceived authority, staff usually observe acquainted patterns somewhat than pause to problem intent. This isn’t a failure of expertise, however a failure of course of design.
Sensible steps for IT leaders embrace redesigning approval workflows in order that high-value transactions require multi-step verification together with out-of-band name to substantiate, simulating BEC eventualities in reasonable workout routines to establish gaps in response and decision-making, embedding security consciousness into every day routines utilizing micro-learning and actual incident evaluations, and empowering groups to problem uncommon requests with out worry of reprisal. Situations of profitable assaults may also be shared with staff who distribute invoices, monetary paperwork or oversee making selections relating to transfers
Designing approval workflows that thwart BEC assaults
Redesigning approval workflows means explicitly defining what constitutes a high-risk request, reminiscent of first-time funds, adjustments to vendor banking particulars, sudden cost requests from an government or requests that bypass customary procedures. These requests ought to require unbiased verification utilizing recognized contact particulars, not info offered within the electronic mail itself.
When reviewing and redesigning approval workflows, organizations ought to start by asking salient, arduous, operational questions on the decision-making level. Does this request align with how funds are usually initiated/permitted? Is the requester the everyday communication channel and tone? Has this vendor or account been paid earlier than, and beneath related circumstances? Does the e-mail tally with the one on the sender’s firm web site with out alterations? Is there a special reply-to electronic mail seen? Can a fast name to substantiate be made? Groups must also ask what assumptions are being made beneath time strain, whether or not authority is being inferred somewhat than verified, and who’s accountable if the choice seems to be unsuitable. These questions power staff to decelerate, acknowledge deviations from regular conduct and deal with uncommon requests as potential security occasions somewhat than routine enterprise duties.
Simulating BEC transcends phishing assessments and will mirror actual enterprise eventualities, together with pressing government requests or provider cost adjustments, permitting organizations to watch how employees reply to strain and ambiguity. Efficient simulations introduce urgency, impersonate authority figures with typosquatted emails and exploit reasonable enterprise contexts reminiscent of end-of-quarter funds, provider adjustments and occasions of the 12 months when attackers wish to strike reminiscent of festive durations and earlier than holidays. Individuals are noticed on how they confirm requests, whether or not they escalate issues and the way shortly they transfer to execution with out affirmation. The result just isn’t a cross or fail rating however can present perception into the place processes encourage compliance over warning. These simulations permit organizations to refine approval guidelines, reinforce escalation paths and normalize verification as a part of on a regular basis operations.
Empowerment have to be formalized by coverage, making it clear that pausing or escalating a suspicious request is anticipated conduct, not an impediment to productiveness. Workers who report suspicious requests additionally needs to be inspired and used nearly as good examples in inner communications the place potential.
Utilizing friction and alerts in workflows
Insights from cross-border operations is that attackers exploit time strain and government assumptions usually seen in CEO/CFO themed fraud. Groups usually observe cues from perceived authority, scoped by attackers from electronic mail flows and urgency usually hooked up to creating giant funds, tying them to vital enterprise wants. By implementing friction in vital workflows reminiscent of obligatory pauses for giant transfers or automated anomaly alerts, organizations can scale back danger with out hampering productiveness
Efficient friction doesn’t imply indiscriminately grinding the enterprise or its course of to a halt. Obligatory pauses for giant or uncommon transfers create area for verification and scale back impulsive selections and actions. Throughout these pauses, particular actions ought to happen, reminiscent of electronic mail/signature checks, verbiage, secondary approval, unbiased affirmation or automated checks in opposition to historic cost conduct as said above.
Automated anomaly alerts are solely helpful after they give attention to deviations that matter and are tied to clear response expectations. Alerts ought to prioritize eventualities reminiscent of out-of-hours cost requests, adjustments to established vendor particulars or transfers that fall outdoors regular patterns. Possession of BEC-related alerts ought to sit with groups that management monetary selections, reminiscent of finance operations, fraud danger models or cross-functional cost danger teams that mix security and enterprise authority, somewhat than being routed completely to noisy SOC queues.
To scale back false positives additionally, the idea of enhanced monitoring for precedence accounts must also be launched. This may be made higher by routing emails containing particular cost key phrases to those danger teams to guage earlier than touchdown within the supposed inboxes.
What security leaders ought to change now
BEC continues to succeed as a result of human determination factors are not often handled as security-critical methods. MFA, electronic mail filtering and endpoint protections stay essential, however they don’t management how individuals make selections beneath strain. Till monetary and government workflows are designed with the identical rigor utilized to technical methods, attackers will proceed to use the affect of human conduct on cybersecurity with social engineering and human weaknesses on the prime of the pile.
Added to this, there must also be clear possession of BEC danger on the management degree. If no single position is accountable for cost verification failures, accountability defaults to frontline employees beneath strain who usually bear the brunt of being sacked or prosecuted following profitable BEC assaults. Assigning possession to finance management, danger committees or cross-functional governance teams ensures that course of failures are handled as systemic points somewhat than particular person errors.
Though equally necessary, leaders mustn’t measure success solely by the variety of blocked phishing emails, however by how usually verification steps are adopted, what number of cost requests are challenged and the way shortly suspicious transactions are paused and reviewed.
In conclusion, security leaders who scale back BEC danger align individuals, processes and expertise in order that verification turns into routine, hesitation is suitable and authority isn’t assumed with out affirmation. In 2026 and past, enterprise workflows ought to proceed to be handled as a core a part of the security structure and never a peripheral element.
This text is revealed as a part of the Foundry Knowledgeable Contributor Community.
Need to be part of?
