Read-only email evaluation exposed a CEO impersonation gap

At a glance

What this is: This is an analysis of how a read-only email security evaluation surfaced a live CEO impersonation attack that a secure email gateway missed.

Why it matters: It matters because identity-driven email fraud often bypasses content filters, so IAM and security teams need detection that evaluates intent, not just payload.

By the numbers:

• Keelings monitored 3.5 million emails in the first 90 days of deployment.
• IRONSCALES automatically remediated 584 email attacks in the first 90 days.
• The platform caught 742 impersonation attempts through exact display-name matching.
• Employees sent 65 reports through the phishing button.

Context

CEO impersonation and vendor fraud often succeed because the message content looks legitimate enough to pass traditional secure email gateway filters. When the attack has no malicious attachment or link, the control problem shifts from payload inspection to identity and intent verification, which is where email fraud keeps outpacing rule-based defenses.

This case sits at the intersection of email security, identity governance, and fraud prevention. The practical issue is not whether a mailbox can receive mail safely, but whether the organisation can recognise when a trusted name is being used to push an unsafe action. That makes the article relevant to teams responsible for human identity, phishing resilience, and enterprise access governance.

Key questions

Q: What breaks when CEO impersonation messages contain no malicious link or attachment?

A: Content-scanning gateways lose most of their value when the attack is social rather than technical. If the message looks clean, the defender must rely on identity-aware signals such as sender behaviour, relationship patterns, and unusual request context. Without those controls, executive impersonation can pass as ordinary business mail and trigger fraud.

Q: Why do executive impersonation attacks create risk even when the mail gateway is working?

A: Because the gateway may be doing exactly what it was designed to do, while the attacker is exploiting a gap in its threat model. A content-based control is weak against clean-text requests that borrow a trusted name and create urgency. The risk comes from the mismatch between the attack method and the inspection model.

Q: How do security teams know if email compromise detection is actually working?

A: Look for whether the programme detects suspicious sign-in locations, device mismatches, abnormal east-west traffic, and deviations in vendor or employee communication patterns before fraud occurs. If alerts only appear after a malicious attachment or known bad URL is seen, the control is still too dependent on legacy indicators.

Q: When should organisations add post-delivery email inspection instead of relying only on a secure email gateway?

A: They should add it when business email compromise, impersonation, or clean-text fraud is reaching users despite normal gateway filtering. Post-delivery inspection is most useful when the attack depends on trust and context rather than malware. It gives the defender a second chance to detect abuse after the message lands.

Technical breakdown

Why content-scanning gateways miss CEO impersonation

Traditional secure email gateways are optimised for known-bad indicators such as malicious links, weaponised attachments, and suspicious infrastructure. CEO impersonation attacks often contain none of those signals. The message may be clean text, plausible timing, and a trusted display name, which means a content-first model has very little to score. In practice, the attacker is abusing trust, not code. That is why the control boundary has to move from message payload to sender behaviour, communication patterns, and user context.

Practical implication: teams should treat clean-text impersonation as a control-gap problem, not a spam-filter tuning problem.

How mailbox-level analysis changes the detection model

Mailbox-level analysis through an API lets a platform inspect delivered mail and compare it with normal communication patterns, such as who usually emails whom, how executives write, and what requests look abnormal. That shifts detection from static signatures to behavioural and contextual scoring. It also avoids inserting another mail-flow hop, which matters when security teams want to add inspection without introducing delivery fragility. The technical value is not just deeper visibility, but the ability to act after delivery when the gateway has already passed the message.

Practical implication: evaluate whether your email stack can analyse delivered mail without changing routing or increasing outage risk.

Why read-only proof of concept matters for fraud and impersonation control

A read-only proof of concept is a governance step as much as a technical one. It lets defenders measure how many attacks are already landing before they permit auto-remediation. In this case, the evaluation surfaced a live impersonation that the incumbent had missed, which provided evidence that the gap was real, not hypothetical. For teams that face business email compromise, the point of the trial is to validate detection on live traffic before allowing the control to move from observation to enforcement.

Practical implication: start impersonation controls in observe mode so you can prove coverage before enabling automated response.

Threat narrative

Attacker objective: The attacker wanted to trick an employee into transferring value by buying gift vouchers under the guise of an executive request.

1. Entry occurred through a convincing CEO impersonation email that used a trusted executive name rather than a malicious attachment or link.
2. Credential or payload compromise was not required because the attacker exploited social trust and urgency to push a gift voucher purchase request.
3. Impact came when the message bypassed the secure email gateway and a real fraud attempt reached the recipient before the evaluation layer flagged it.

Breaches seen in the wild

• Entra ID actor token flaw (CVE-2025-55241): Hidden Actor tokens plus an Azure AD Graph validation flaw could have let attackers become Global Admin in any Entra ID tenant (CVE-2025-55241).

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Clean-text impersonation is now a governance problem, not just a mail-filter problem. When attackers remove links and attachments, the control failure is not inspection depth but the assumption that malicious content must exist. That assumption no longer holds for business email compromise and executive impersonation, so identity-aware detection becomes part of email governance, not an optional add-on. Practitioners should measure controls against intent-based fraud, not only malware.

Mailbox-level analysis exposes the blind spot created by gateway-centred thinking. A secure email gateway can still be useful, but it is structurally weak against messages that are socially engineered rather than technically weaponised. The article shows why post-delivery inspection, behavioural modelling, and user-context analysis belong in the same operating model. Teams should re-evaluate where inspection happens, because placement determines what the control can actually see.

Business email compromise is increasingly an identity abuse pattern. The attacker is not breaking encryption or exploiting a protocol flaw; they are borrowing trust from a human identity and using that trust to trigger action. That makes this a human identity governance issue as much as a security operations issue, and it aligns closely with fraud prevention, verification, and policy enforcement. Practitioners should govern trusted-name abuse as a control class in its own right.

Read-only evaluation is a useful proof point because it measures the gap before remediation changes the environment. If a tool flags attacks in observe mode that the incumbent already missed, the organisation has evidence of detection debt. That is the right moment to decide whether the problem sits in content filtering, mailbox visibility, or response workflow. Practitioners should use observation periods to validate coverage against live impersonation, not simulated samples.

Intent-based email defence will keep gaining ground because the attack surface is now behavioural. As long as user-facing decisions can be triggered by a believable request, the defender needs controls that understand relationship patterns and business context. The practitioner conclusion is straightforward: if the programme only looks for payload risk, it will keep missing fraud that looks ordinary on the wire.

From our research library:

• Impersonation fraud accounted for over 85% of all fraud attacks in 2025.

What this signals

Identity-aware email defence is becoming necessary because the attack surface has shifted from payloads to trust relationships. Organisations that still judge mail security by attachment and URL detection will keep underestimating executive impersonation and vendor fraud.

Clean-text fraud creates a detection gap that traditional gateways are poorly placed to close. The practical response is to combine post-delivery inspection, behavioural modelling, and user reporting rather than assume a perimeter filter can do all the work.

For practitioners

• Strengthen executive impersonation detection Add behavioural and identity-aware checks for messages that reference senior staff, urgent requests, payment, or vouchers, especially when there is no malicious attachment or link.
• Run new controls in observe mode first Use read-only deployment to compare detections against your existing gateway before enabling remediation, so you can prove what the incumbent misses on live traffic.
• Review post-delivery inspection coverage Map where email analysis happens in the stack and confirm you can inspect delivered mail without introducing a new mail-flow hop or delivery failure point.
• Measure fraud detection beyond payload scanning Track how many impersonation attempts are detected by context, display-name abuse, and communication-pattern anomalies rather than by URL or attachment filtering alone.

Key takeaways

• CEO impersonation is now a governance and fraud problem as much as an email security problem, because attackers can bypass content-based controls with clean-text requests.
• Read-only evaluations can expose a real detection gap before remediation is enabled, which gives defenders evidence about what the gateway misses.
• Post-delivery analysis and behavioural modelling are the controls most likely to reduce business email compromise when the attack carries no payload.

Key terms

• Business email compromise: A form of social engineering where an attacker impersonates a trusted person or domain to manipulate payment, change banking details, or extract sensitive information. It often succeeds without malware because the attacker targets process trust and human judgement instead of technical controls.
• Executive impersonation: Executive impersonation is a social engineering tactic where an attacker poses as a senior or trusted person to influence decisions or approvals. The goal is not always account takeover. It is often to exploit authority, urgency, and familiarity to make a person bypass normal checks.
• Post-Delivery Email Inspection: A control pattern that evaluates messages after they arrive in the productivity environment rather than stopping them only at the gateway. It matters because modern phishing often blends into legitimate business traffic, so security teams need detection that works closer to user workflows and account context.
• Display Name Abuse: A social engineering method where the attacker places deceptive text in the sender display name or message fields that users see first. The underlying account may be legitimate, but the visible identity claim is crafted to create urgency, confusion, or trust.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and identity lifecycle control. It helps security and identity practitioners connect trust, access, and governance across human and non-human identity programmes.