Business email compromise

Business email compromise goes after the process rather than the technology. A believable message drops into a normal workflow and asks for an ordinary thing to happen slightly differently.

There is often no malware and nothing to detect. Just an email, sometimes from a genuinely compromised account, saying the bank details have changed or this invoice needs paying today. It works because the request is the kind your organisation handles all the time. The defence is procedural rather than technical: a rule that changing payment details always gets confirmed by phone, on a number you already had.