How should security teams reduce business email compromise risk when employee reporting rates are extremely low?

Security teams should not rely on employee reporting as the primary detection layer for business email compromise. The better approach is to baseline normal communication patterns, detect subtle shifts in sender behavior and message content, and automatically remediate suspicious mail before users can engage. Awareness training still matters, but it should support, not replace, controls that stop attacks in the inbox.

Why low reporting rates change the detection model

When employee reporting is weak, business email compromise cannot be treated as a people-driven detection problem. The control objective shifts from waiting for users to notice a suspicious email to finding the campaign before a user interacts with it. That means defenders need mail security, identity signals, and sender-behavior analytics to carry most of the detection burden.

In practice, that changes what “good” looks like. A strong program does not ask whether staff are diligent enough to catch every lure; it asks whether the environment can identify abnormal sender patterns, message timing, reply-chain manipulation, and payment or account-change language quickly enough to interrupt the attack path.

What controls matter most against business email compromise

The most effective controls are the ones that stop or divert suspicious mail automatically. Baseline normal communication patterns, flag deviations in sending behavior, inspect for lookalike domains and impersonation cues, and quarantine messages that attempt invoice fraud, payroll diversion, or credential theft. If your only strong control is awareness training, the program is already underpowered.

Because BEC often succeeds through trust rather than malware, defenders should also watch for account takeover indicators, inbox-rule abuse, and anomalous forwarding or delegation. Those are often the earliest signs that an attacker has moved from message delivery to operational control of the mailbox.

Automated remediation matters because speed is part of the control. A message that is merely reviewed later may already have been acted on. The goal is to reduce the time between suspicious delivery and containment, not to create another manual queue that depends on user escalation.

How to balance awareness, automation, and response

Awareness training still has a role, but it should be measured as a secondary layer. It is most useful for reinforcing verification habits around payment changes, recipient changes, and urgent requests, especially when the message slips through technical filters. Training is not a substitute for inbox-level prevention or detection.

Teams should also define what happens after a suspicious message is detected. That includes deleting or quarantining the message, checking for similar mail in other inboxes, and validating whether any related mailbox rules, OAuth grants, or forwarding settings were created during the campaign. The response playbook should assume some users will never report, and some will report too late.

The practical test is whether your detection stack can still work when the workforce is silent. If it cannot, the organisation is relying on luck and human vigilance rather than a defensible control design.

Risk and Threat Considerations

Low reporting rates create a blind spot that BEC actors can exploit by blending into normal business communication. When users do not report suspicious mail, attackers get more dwell time, more chance to hijack a reply chain, and more opportunity to pivot into payment fraud or mailbox persistence.

Failure mechanism: The organisation overweights awareness and underweights inbox controls, so the first reliable detection signal arrives only after a user has already been manipulated or a transaction has begun.

Impact: Delayed detection increases financial loss, account compromise risk, and the chance that a single phish becomes a broader mailbox or identity incident.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
MITRE ATT&CK	T1114 — Email Collection	BEC relies on mailbox access and message abuse to execute fraud.
Recommendation — Monitor mailboxes for rule abuse, forwarding changes, and suspicious message collection behavior.
NIST SP 800-53 Rev 5	SI-4 — System Monitoring	Behavioral detection and automated response depend on monitoring suspicious email and account activity.
	AU-6 — Audit Record Review, Analysis, and Reporting	BEC defense needs review of mail, login, and forwarding events to detect subtle compromise.
Recommendation — Deploy monitoring that flags anomalous mail flow and mailbox behavior for rapid containment. Review email and identity audit events for indicators of impersonation, forwarding, and takeover.
NIST CSF 2.0	DE.CM-03 — Personnel activity is monitored to detect potential cybersecurity events	Low reporting rates make continuous detection of suspicious communication and account activity more important.
	PR.AA-05 — Access permissions and authorizations are managed, incorporating the principle of least privilege	BEC often escalates through mailbox, forwarding, and account privileges that should be tightly scoped.
Recommendation — Correlate user, mail, and account activity to detect BEC without depending on employee reports. Limit mailbox and forwarding permissions so compromised accounts cannot broaden attacker reach.

Practitioner Guidance

What to prioritise: Build detection around message and account behavior, not employee reaction. If reporting is low, treat that as a control-design constraint, not a training issue to solve first.

What to verify: Confirm that suspicious mail is being blocked, quarantined, or rewritten before delivery, and that alerting reaches responders even when no user reports the message. Also verify that mailbox-rule and forwarding anomalies are reviewed as part of BEC response.

Practitioner takeaway: The best BEC program assumes users will miss many attacks, so the mailbox, not the employee, must be the primary detection and containment layer.