A Very Attacked Person is an individual who is the focus of repeated, targeted cyber abuse because of their role, access, or profile. In identity security, the term describes high-risk users who need stronger monitoring, phishing resistance, device controls, and rapid response across IAM, endpoint, cloud, and communications channels.
Why Very Attacked Person Matters
A Very Attacked Person is not just a user who receives more spam. The label identifies someone whose compromise would be especially valuable, or whose public profile makes them more likely to be singled out, so defenders need to treat them as a distinct protection tier.
The security significance comes from concentration of attention, not from a separate account type. When a person is repeatedly targeted, the defender is really managing a higher likelihood of credential theft, social engineering, session hijack, device compromise, and abuse of trusted communications channels.
Common Attack Patterns Against High-Risk Users
Very attacked users are often targeted through phishing, SMS or voice impersonation, malicious OAuth consent, password resets, and device enrollment abuse. Attackers often prefer these paths because they bypass hardened perimeter controls and exploit trust in familiar workflows.
Identity compromise is especially dangerous here because one successful login can expose mailboxes, collaboration tools, cloud consoles, finance systems, or privileged workflows. In practice, the attacker is often looking for the fastest route from a human account to downstream access, persistence, or data theft.
Controls That Reduce Exposure
The most effective defenses reduce both the chance of takeover and the blast radius if an attempt succeeds. That usually means phishing-resistant authentication, strong session controls, tightly managed device posture, conditional access, and closer monitoring of mailbox, cloud, and collaboration activity.
For these users, security teams should also pay attention to account recovery paths, help desk verification, delegated access, and forwarding or token abuse. Those “support” functions are common weak points because attackers know they can turn a small identity weakness into broad access.
How Organisations Operationalise Protection
Protecting a very attacked person is a cross-team process, not a single setting. Security, IAM, endpoint, SOC, and executive support functions need a shared view of who is in scope, what channels they use, and what response steps should happen when abuse is suspected.
That operational model should include rapid containment for suspicious sign-ins, mailbox rule changes, new device enrollments, and unusual consent grants. The goal is to shrink dwell time and make it harder for a repeated attacker to keep reusing the same access path.
Because the pattern is about repeated targeting, the protection model should be reviewed continuously as roles, travel patterns, devices, and external exposure change.
Risk and Threat Considerations
Repeated targeting raises the odds that one attack will eventually succeed, especially when the attacker can mix phishing, account recovery abuse, and trusted-channel impersonation. The main risk is not only account takeover, but also quiet persistence through sessions, forwarding rules, delegated access, or cloud app consent.
Failure mechanism: The attacker exploits a human trust boundary, then uses valid access to move from a single account into messaging, identity, and cloud resources before defenders notice.
Impact: Compromise can expose sensitive communications, internal documents, authentication material, and downstream systems that trust the person’s account or messages.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5, NIST SP 800-63 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-2 — Identification and Authentication (Organizational Users) | High-risk users depend on stronger user authentication to reduce takeover risk. |
| AC-6 — Least Privilege | High-risk users should not have broad access that magnifies one compromise. | |
| AU-6 — Audit Review, Analysis, and Reporting | Repeated targeting requires closer review of sign-in and account activity signals. | |
| Recommendation — Require stronger authentication and tighter sign-in controls for high-risk user accounts. Limit account privileges so a single compromise cannot expose unnecessary systems or data. Review high-risk user activity for suspicious access patterns and response triggers. | ||
| NIST SP 800-63 | AAL2 — Authenticator Assurance Level 2 | Stronger authenticator assurance helps reduce phishing and replay exposure for targeted users. |
| Recommendation — Use phishing-resistant authenticators where possible and step up assurance for sensitive actions. | ||
| NIST Zero Trust (SP 800-207) | AC-6 — Least Privilege Access | Zero Trust limits trust in user context and reduces blast radius after compromise. |
| Recommendation — Enforce conditional access and least privilege so each request is re-evaluated continuously. | ||
Practitioner Guidance
Why practitioners should care: A very attacked person should be treated as a living attack surface, not a standard user with a bigger inbox. Their protection level should reflect both the value of the account and the likelihood that adversaries will keep trying until they succeed.
Common misunderstanding: Extra awareness training alone is rarely enough. The practical difference comes from stronger authentication, tighter device and session control, faster anomaly detection, and a response path that can act before the attacker settles in.
Practitioner takeaway: Build a repeatable high-risk-user protection process so the same person does not have to be defended through ad hoc one-off interventions each time they are targeted.