Why do compromised email accounts still create business email compromise risk?

Because once an attacker controls a valid mailbox, the messages often look legitimate to users and to some security tools. The attacker no longer needs to impersonate from outside the system. That is why account takeover, delegated access, and lifecycle gaps are the real drivers of business email compromise in cloud email environments.

Why This Matters for Security Teams

Compromised email accounts remain a high-value path for business email compromise because mailbox access provides legitimacy, conversation context, and an internal trust position that external spoofing cannot match. Once an attacker operates from a valid account, they can read prior threads, observe approval flows, and inject messages that align with normal business rhythm. That makes detection harder for users and for tools that focus on sender reputation alone.

This is why cloud email risk is not just a phishing problem. It is an identity problem, a session problem, and a lifecycle problem. NHI Management Group’s research on identity abuse shows how quickly compromised credentials can be turned into operational impact, and the same logic applies to mailbox control when access is not tightly governed. See the 52 NHI Breaches Analysis and the Ultimate Guide to NHIs — Why NHI Security Matters Now for the broader pattern of identity-driven compromise.

Practitioners should treat mailbox takeover as an authenticated attack surface, not a messaging anomaly, because the attacker is often already inside the trust boundary by the time the first fraudulent instruction is sent. In practice, many security teams encounter BEC only after payment diversion or approval abuse has already occurred, rather than through intentional detection of account takeover.

How It Works in Practice

A compromised mailbox becomes dangerous because it can be used in ways that look operationally normal. Attackers typically do not need to spray obvious phishing emails once they have access. They can search for invoice threads, forward messages, create inbox rules, impersonate executives, and reply inside existing conversations. That combination of context and legitimacy is what makes BEC persistent.

The most effective controls focus on account state, session behavior, and mail flow governance rather than message content alone. Current guidance suggests aligning mailbox protections with identity assurance principles from the NIST Cybersecurity Framework 2.0 and using strong detection for delegated access, rule creation, and impossible travel. NHI Management Group’s Top 10 NHI Issues also highlights lifecycle gaps as a recurring failure mode when access is not removed fast enough after role changes or departures.

In practice, teams should combine:

• phishing-resistant authentication where possible
• session revocation after suspicious sign-in events
• monitoring for inbox forwarding and delegation changes
• conditional access tied to device, location, and risk signals
• tight offboarding and periodic entitlement review

Mailbox telemetry matters because many BEC campaigns begin with low-noise reconnaissance inside the account before fraud is attempted. The risk is amplified when legacy protocols, weak recovery paths, or over-permissive delegation remain enabled. The same access pattern that supports convenience for staff can become an attacker’s best persistence mechanism. These controls tend to break down in large federated tenants because legacy mail clients, shared mailboxes, and unmanaged delegated permissions create hidden paths that are hard to inventory.

Common Variations and Edge Cases

Tighter mailbox control often increases support overhead, requiring organisations to balance fraud reduction against user friction and helpdesk load. That tradeoff is real, especially where executives, finance teams, and assistants rely on delegated access for legitimate business operations.

Best practice is evolving around how much mailbox autonomy should be allowed for high-risk roles. In some environments, static inbox permissions are acceptable only when paired with continuous monitoring and explicit workflow controls for payments, vendor changes, or password resets. In others, the stronger answer is to reduce reliance on email for sensitive approvals altogether.

There are a few important edge cases. Shared mailboxes can mask ownership unless access is tightly logged. Third-party applications with mail permissions can create a separate compromise path even when the user password is secure. Automated forwarding to external addresses may be legitimate in rare cases, but it should be exceptional and reviewed. For broader identity compromise trends, the 2024 ESG Report: Managing Non-Human Identities notes that 72% of organisations have experienced or suspect a breach of non-human identities, which reinforces how often identity abuse becomes operational before it is noticed. The emerging lesson from the Anthropic AI-orchestrated cyber espionage report is that adversaries increasingly chain identity abuse with automation, which makes rapid containment more important than perimeter assumptions.

Ultimately, compromised email creates BEC risk whenever the account is trusted more than the message is inspected. That is why lifecycle hygiene, permission review, and transaction verification remain necessary even when email security tooling appears strong.

Related resources from NHI Mgmt Group

• Why do non-human identities create more risk than many human accounts?
• Why do non-human identities create more remediation risk than many human accounts?
• Why do shared service accounts still create risk even when secrets are vaulted?
• Why do consumer AI accounts create more risk than business tiers?