Business process compromise is the manipulation of an organisation’s normal workflows to divert money, data, or approvals without obvious technical intrusion. Attackers abuse payment, procurement, HR, or identity workflows by impersonating trusted parties. Defenders enforce approval checks, change verification, segregation of duties, and anomaly detection in business processes.
How Business Process Compromise Works
Business process compromise is dangerous because it targets the way work is supposed to move, not just the software that supports it. Attackers exploit trust in routine approvals, invoice handling, procurement steps, HR requests, or access workflows so the result looks like an ordinary business action rather than a clear intrusion.
That makes the compromise harder to spot early. A manipulated workflow can produce a valid payment, a changed bank detail, a diverted approval, or an unauthorized data release while leaving only subtle inconsistencies in the underlying records.
Where the Process Is Exploited
Most business process compromise succeeds by inserting a believable step into an existing process, such as a fake request, a changed destination account, a fraudulent manager approval, or a trusted-looking identity change. The weakness is often not a broken system control, but overreliance on the process being followed correctly by people and systems.
The same pattern appears across payment, procurement, HR, and identity administration. In a mature environment, the attacker does not need to defeat every control at once; they only need one point where a workflow accepts an unverified change or a trusted exception.
When the workflow involves email, shared inboxes, or mailbox rules, the boundary between communication and approval can be especially fragile. NHIMG’s Email Identity and BEC Guide shows why impersonation-resistant verification matters when payment and account-change requests arrive through normal business channels.
Why It Matters for Trust and Controls
Business process compromise turns ordinary trust into an attack surface. Because the transaction itself may be authorised by a legitimate person or system step, the organisation can suffer loss even when perimeter security, endpoint tooling, and basic authentication look healthy.
That is why controls such as segregation of duties, dual approval for sensitive changes, change verification, and exception handling matter. The goal is to make it difficult for one spoofed request, one compromised mailbox, or one misleading approval chain to complete the entire workflow on its own.
It also means monitoring must focus on business anomalies, not only technical alerts. A sudden bank-account change, a new payment route, an unusual rush request, or a deviation from normal approval sequence can be more revealing than malware-centric signals.
Detection and Recovery After a Suspected Compromise
Detection depends on comparing the request to the process that should have happened, not only the request that did happen. That includes reviewing approval logs, change histories, payment records, identity records, and communications for signs of mismatch, duplication, or unusual timing.
After a suspected compromise, organisations should assume the workflow itself may have been contaminated. That often means reviewing all related records, confirming downstream recipients, and checking whether any connected account, mailbox, or approval path was also abused. NHIMG’s Arup deepfake fraud 2024 is a strong example of how a convincing social or approval event can trigger a large financial transfer without a traditional technical exploit.
For broader attack-pattern context, CISA’s Known Exploited Vulnerabilities Catalog helps defenders pair process review with exposure management when a workflow compromise is part of a wider intrusion chain.
Risk and Threat Considerations
Business process compromise is risky because it can bypass controls that are aimed at systems, while abusing the business logic that people rely on. The impact can include fraudulent payment, unauthorised data disclosure, payroll diversion, identity changes, or approval of actions that would never pass normal scrutiny.
Failure mechanism: The attacker impersonates a trusted party or alters a legitimate workflow so the organisation treats a malicious request as routine, then the process itself carries the fraud to completion.
Impact: Losses can be financial, operational, or reputational, and the compromise may persist until reconciliations, audit checks, or anomaly reviews expose the mismatch.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5, CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-5 — Separation of Duties | Business process compromise exploits weak approval separation and role overlap. |
| AU-6 — Audit Record Review, Analysis, and Reporting | Workflow abuse is often found by reconciling approvals, changes, and transactions. | |
| IA-5 — Authenticator Management | Compromised credentials often enable impersonation inside business workflows. | |
| Recommendation — Enforce separation of duties so no single actor can complete sensitive workflow changes alone. Review audit records for abnormal approval chains, payment changes, and identity updates. Manage authenticators tightly to reduce impersonation in approval and payment processes. | ||
| CIS Controls v8 | CIS-5 — Account Management | Process compromise often leverages account changes, mailbox abuse, or improper access paths. |
| Recommendation — Harden account lifecycle controls so attackers cannot quietly alter workflow permissions. | ||
| NIST CSF 2.0 | PR.AA-05 — Identity Management, Authentication and Access Control | Process compromise commonly depends on abusing trusted identities or approvals. |
| Recommendation — Apply strong identity and access control to sensitive workflow steps and exceptions. | ||
Practitioner Guidance
Why practitioners should care: The main defensive task is not just blocking intrusion, but preserving the integrity of the decision path. If a process can be steered by one convincing request or one weak exception path, it can be abused at scale even in environments with strong perimeter controls.
Practitioner takeaway: Treat critical workflows as security boundaries, verify changes out of band where the business impact is high, and watch for unusual combinations of urgency, identity change, and payment or approval action.
Related resources from NHI Mgmt Group
- Why can a compromise of Intune or similar tools cause business disruption without malware?
- Why do compromised email accounts still create business email compromise risk?
- Who is accountable when a trusted cloud identity is used for business email compromise?
- Who is accountable when compromised cloud identity is used for business email compromise?