Business email compromise shifts with org size and internal trust

At a glance

What this is: This analysis shows that BEC risk is shaped less by volume than by organizational structure, with impersonation tactics changing as companies scale.

Why it matters: IAM and security teams need to account for workflow credibility, internal trust patterns, and account compromise paths, not just obvious executive impersonation.

By the numbers:

• Business email compromise represents roughly 11% of attacks by volume, versus phishing's 58%.
• VIP impersonation drops from 43% to 7% of named-identity BEC as organization size grows.
• Lateral BEC hits 23.2% of all BEC at large enterprises but just 0.24% at small organizations.

Context

Business email compromise is a workflow abuse problem, not just an impersonation problem. Attackers do not only mimic leaders, they study who employees trust, which approvals are normal, and where a request can look routine enough to bypass scrutiny.

In identity governance terms, the risk shifts with org size because the credibility of a message is tied to the organisation’s internal trust structure. As the workforce grows, named executive impersonation loses relative power, while peer impersonation and compromised-account abuse become more viable paths to action.

Key questions

Q: What breaks when BEC defenders focus only on executive impersonation?

A: They miss the shift to employee impersonation and compromised internal accounts that becomes more common as organisations scale. The result is a control strategy built around obvious authority cues, while attackers move to messages that look ordinary, local, and routine to the target. Real defence has to cover peer trust, workflow realism, and mailbox compromise.

Q: Why does BEC get harder to spot inside larger organisations?

A: Larger organisations create more legitimate senders, more approval chains, and more normal internal traffic for attackers to blend into. That makes peer impersonation and lateral compromise more credible than executive spoofing. The practical challenge is not only scale, but the loss of simple social verification that small teams still have.

Q: How do security teams know whether BEC controls are actually working?

A: Look for fewer successful fraudulent approvals, faster reporting of suspicious requests, and lower dependence on email content alone for decision-making. If users still complete sensitive actions without secondary validation, the control environment is not blocking the real attack path.

Q: What should teams do when a legitimate internal account is used in a fraud attempt?

A: Treat it as a trust-channel compromise, not only a user-account issue. Contain the mailbox, review recent messages and forwarding rules, identify any approvals or transfers triggered by the account, and reset the surrounding assumptions about which internal senders can be trusted without challenge.

Technical breakdown

Why internal impersonation changes with organisation size

Internal impersonation BEC works because the attacker borrows credibility from a known identity or a familiar function. In smaller organisations, executives are more visible and direct contact is plausible, so VIP impersonation carries weight. In larger enterprises, executives are less likely to email operational teams directly, and the attack surface broadens to peer-level messages, helpdesk-style prompts, and department-specific lures. The shift is not random. It reflects which identities remain believable once workflows, reporting lines, and approval chains become more formalised.

Practical implication: Map which identities are credible at each organisational layer, not just which accounts are high value.

Why compromised accounts change the BEC equation

Lateral BEC differs from classic impersonation because the message comes from a legitimate internal account. That means normal authentication checks are no longer enough to distinguish malicious from benign traffic, and recipients inherit trust from the sender’s real position inside the organisation. At scale, this becomes more attractive because one compromised mailbox can reach many departments, approvals, and ongoing conversations. The technical issue is not only compromise, but the reuse of trusted communication channels as an attack path.

Practical implication: Treat account compromise as a trust-channel problem, not only a credential problem.

Why workflow realism is the decisive control surface

Generic internal impersonation succeeds when the lure mirrors an ordinary task. Fake IT reset prompts, HR notices, payroll alerts, and provisioning requests work because they resemble messages employees already expect. The closer the pretext matches actual workflow, the less verification it requires from the target. That is why finance, IT, and executive leadership show distinct patterns: each group sees a different set of routine communications, so each group is vulnerable to a different style of believable request.

Practical implication: Base controls on workflow realism, approval paths, and sender provenance rather than broad awareness training alone.

Threat narrative

Attacker objective: The attacker wants to convert internal trust into authorised action, whether that means payment, credential capture, or deeper account access.

1. Entry occurs when the attacker either impersonates a named colleague or executive, or gains control of a real internal mailbox through compromise.
2. Escalation happens when the message is tuned to a believable workflow, such as IT, finance, HR, or executive communication, so the recipient acts without extra verification.
3. Impact follows when the target approves a payment, shares credentials, or complies with a request that should have been challenged, allowing fraud or further compromise to proceed.

Breaches seen in the wild

• Amazon AWS Hacked Accounts Crypto-Mining: Compromised IAM credentials across multiple AWS accounts fuel large-scale crypto-mining campaign.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Internal trust, not just identity spoofing, is the real attack surface in BEC: The report shows that attackers do not rely on a single impersonation style. They change targets and pretexts as organisations scale, because credibility is shaped by how work actually moves through the business. The practitioner lesson is that trust boundaries need to be mapped around workflow, not org chart alone.

Peer familiarity becomes more dangerous than executive authority at scale: VIP impersonation loses share as organisations grow, while employee impersonation and lateral compromise rise. That tells us BEC is less about “high status” and more about whatever message feels routine inside a given environment. For practitioners, this means the control problem is context validation, not simply training people to distrust the C-suite.

Compromised internal accounts turn trust into transport: Once an attacker operates from a legitimate mailbox, authentication no longer resolves the question of intent. The mailbox is real, the sender is real, and the channel is trusted, which is exactly why lateral BEC scales in large enterprises. The implication is that governance must treat internal senders as potential trust anchors that can be abused, not just as authenticated users.

Workflow-specific lures expose a governance gap in approval design: Helpdesk, payroll, provisioning, and executive-request patterns succeed when the business has normalised fast action without meaningful out-of-band validation. That is a process failure, not just a user-awareness issue. The practical conclusion is that BEC defence has to examine where routine operations have become indistinguishable from social engineering.

Named identity impersonation should be managed as a lifecycle and trust problem: The same named identity can be a subject, a sender target, or a trusted reference point depending on organisational size. That means identity governance for BEC is not only about protecting mailboxes, but about understanding which identities carry implicit authority in which workflows. Practitioners should re-evaluate those trust assumptions as the organisation scales.

From our research library:

• Businesses report a 200% surge in attempted deepfake-aided wire fraud in Q1 2025 alone.

What this signals

Identity structure determines BEC exposure more than raw attack volume: As organisations grow, the most believable impersonation target changes, and the most dangerous attacks are often the ones that fit local workflow too well. That means BEC defence has to be designed around organisational credibility patterns, not only phishing awareness.

The most important control question is no longer whether a message looks suspicious in isolation. It is whether the organisation has built enough verification friction into the actions that matter most, especially where internal senders can trigger money movement, access changes, or privileged approvals.

For practitioners

• Map internal trust paths by role and workflow Identify which messages finance, IT, HR, and executive teams treat as routine, then pinpoint where a named sender or department label is enough to trigger action.
• Separate mailbox authentication from trust validation Require additional checks for requests that move money, reset access, or change approvals, even when they come from a legitimate internal address.
• Reduce exposure to peer-level impersonation Review which colleagues, managers, and support teams are most likely to be trusted without challenge, then tighten verification for those communication paths.
• Harden workflows that attackers mirror Focus on payroll, helpdesk, provisioning, and executive approval steps that already look normal to employees, because those are the most credible BEC pretexts.

Key takeaways

• BEC is a low-volume but high-cost attack pattern, and its credibility changes with organisation size and internal structure.
• The report shows a clear substitution effect: VIP impersonation declines as employee impersonation and lateral compromise become more effective in larger enterprises.
• Defence should focus on workflow validation, secondary verification, and trust-channel monitoring rather than only on executive impersonation awareness.

Key terms

• Business email compromise: A form of social engineering where an attacker impersonates a trusted person or domain to manipulate payment, change banking details, or extract sensitive information. It often succeeds without malware because the attacker targets process trust and human judgement instead of technical controls.
• Impersonation: Impersonation is a controlled administrative action that lets an authorised operator assume a user context for debugging or support. In a well-governed setup it preserves audit logging, limits exposure of credentials, and keeps production authentication separate from local troubleshooting.
• Lateral BEC: Lateral BEC is business email compromise sent from a compromised internal account rather than a fake identity. Because the email comes from a real mailbox, it inherits authentication and familiarity signals, which makes it harder to detect and more likely to succeed inside larger, interconnected organisations.
• Workflow Credibility: Workflow credibility is the degree to which a request matches how a team actually works. In BEC, attackers exploit this by copying the timing, wording, and approval pattern of legitimate internal communication, so the message feels routine enough that the recipient acts without secondary verification.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.