Vendor email compromise exposes the limits of legacy email security

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Abnormal AI's blog post: Vendor email compromise succeeds by abusing business trust, not malware, and traditional SPF, DKIM, DMARC, and rule-based filters miss the behaviour that matters.

Why it matters: IAM, security operations, and business teams need to treat vendor identity, communication patterns, and response workflows as part of the control surface, not just email authentication.

By the numbers:

• 44% of employees engage with VEC attacks overall, rising to 72% at enterprises with 50,000+ staff.
• Only 1.46% of VEC attacks are reported.
• 7.3% of engagements come from repeat victims.
• Telecom, energy, and hospitality sectors exceed 70% VEC engagement rates.

Context

Vendor email compromise, or VEC, is a social engineering attack that exploits the trust relationship between an organisation and its suppliers, partners, and service providers. The article argues that the threat is not about malicious payloads or obvious phishing artefacts, but about business processes that assume familiar-looking email is safe by default.

That matters for identity governance because the control boundary is no longer just mailbox authentication. It extends into vendor identity assurance, transaction approval behaviour, and the way teams respond when routine invoices, billing updates, or order confirmations arrive from trusted counterparties.

Legacy email security models were built to inspect content and indicators. VEC bypasses those assumptions by using legitimate accounts, lookalike domains, hijacked threads, and routine business language, which means the defender must reason about trust, not only message characteristics.

Key questions

Q: What breaks when vendor emails pass SPF, DKIM, and DMARC but still lead to fraud?

A: Email authentication only proves that a message can be associated with a sending domain. It does not validate the business intent, the vendor relationship, or the legitimacy of the request. Fraud succeeds when teams treat domain checks as a trust decision instead of one input into a broader approval process.

Q: Why do employees keep engaging with vendor impersonation attacks?

A: Employees often trust the request because it fits a real workflow and arrives from a familiar business context. In some regions, authority cues and partner expectations make the message feel legitimate, while fear of false alarms discourages challenge. The result is repeated interaction, not just a one-time mistake.

Q: What are the signs that a vendor email compromise campaign is bypassing normal email defenses?

A: Common warning signs include messages that arrive from a real vendor account but introduce subtle changes in tone, payment instructions, banking details, or attachment behavior. Another signal is when invoice language or contact patterns differ from the vendor’s normal history. If these shifts are not being surfaced, the email security stack is missing context, not just malicious content.

Q: Should organisations treat vendor trust checks differently from standard email security controls?

A: Yes. Standard email controls focus on message authenticity and known-bad content, while vendor trust checks focus on whether the request fits the established business relationship. Organisations need both, but the second layer is what stops routine-looking fraud in finance and operations workflows.

Technical breakdown

Why SPF, DKIM, and DMARC do not stop vendor email compromise

SPF, DKIM, and DMARC verify that a message was authorised to use a sending domain, but they do not tell you whether the sender is acting in good faith. VEC succeeds because attackers often use compromised vendor accounts, plausible lookalike domains, or legitimate infrastructure that still passes authentication checks. That creates a false sense of safety for mail gateways that stop at domain validation. The deeper issue is that authentication answers “was this domain allowed to send?” while VEC asks “should this request be trusted in this business context?” Those are different questions, and the second one is where the attack lives.

Practical implication: treat email authentication as a hygiene layer, not a decision control for vendor-driven payment or data requests.

How vendor impersonation blends into normal business workflows

VEC is effective because it matches routine operational patterns. Invoices, billing changes, aging reports, RFQs, and order confirmations already trigger action in finance, sales, and operations teams, so the attacker does not need to create urgency from scratch. They only need to look plausible inside an established workflow. When the message fits the expected cadence and the recipient role is built for responsiveness, the probability of a reply rises sharply. In other words, the attack surface is not the inbox alone. It is the combination of business process, external trust, and human expectation.

Practical implication: map which workflows depend on fast vendor responses and add compensating checks before payments or account changes are approved.

Why behaviour-based detection matters more than content inspection

Static rules struggle with VEC because there may be no malicious link, attachment, or known bad indicator to flag. Behavioural detection looks for deviations in communication patterns, device or login changes, reply chains, and message tone shifts that break from the normal relationship history. That is a different security model from signature-based filtering. It is closer to relationship monitoring, where the system learns what normal vendor communication looks like and highlights subtle anomalies. For identity teams, this is the important pivot: trust has to be measured continuously, not inferred from a single authenticated message.

Practical implication: prioritize vendor-behaviour analytics where routine business communication is a documented attack path.

Threat narrative

Attacker objective: The attacker aims to obtain payment, sensitive business data, or durable access to trusted operational channels by impersonating a vendor.

1. Entry occurs when an attacker uses a compromised vendor account, a lookalike domain, or a hijacked thread to deliver a believable request into a real business workflow.
2. The attacker harvests trust rather than credentials by prompting a reply, payment update, or invoice action that validates the social engineering path.
3. Escalation follows when the recipient forwards data, approves a payment change, or opens a route into internal processes that should have required stronger verification.
4. Impact is financial loss, exposed data, and a reduced likelihood of reporting, which allows the same vendor relationship to be abused again.

Breaches seen in the wild

• TruffleNet stolen AWS keys campaign 2025: TruffleNet used 800+ attacker hosts to test stolen AWS keys and check SES capacity; one compromised account sent a fake $50,000 invoice.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Vendor email compromise exposes a trust-governance gap, not an email-delivery problem. SPF, DKIM, and DMARC only prove that a message fits a domain’s sending rules. They do not prove that the business request inside the message is legitimate, which is why legacy controls fail against vendor impersonation. The implication is that email security and vendor trust governance can no longer be separated.

VEC is a control-boundary problem for identity teams because the relevant identity is the counterparty, not the mailbox. When procurement, finance, and operations accept requests from known vendors at face value, the organisation is relying on relationship memory instead of governed assurance. That is a weak foundation for modern supply chains, where a single vendor account can become a delivery channel for fraud.

Repeat victimisation shows that trust loss becomes its own risk amplifier. Once a recipient has engaged once, the workflow, expectation, and habit of response become easier to exploit again. That makes VEC a lifecycle issue as much as a threat issue: the control problem is not only initial recognition, but the persistence of trust after an abuse event.

Vendor-behaviour monitoring is the right named concept for this class of control gap. The decision point is no longer whether an email passed authentication, but whether its cadence, tone, source patterns, and transaction context fit the known vendor relationship. Practitioners should treat behavioural deviation as the primary signal because static reputation checks were not designed for trusted-channel abuse.

Response-oriented roles are a structural weakness, not an individual failing. The article’s role-based engagement pattern shows that teams built to move quickly are the ones most likely to be targeted. The conclusion for practitioners is that speed-sensitive functions need stronger approval design, because trust exploitation is aimed at process velocity.

From our research library:

• Impersonation fraud accounted for over 85% of all fraud attacks in 2025.

What this signals

Vendor email compromise is becoming a workflow security problem. The practical lesson is that the attacker is no longer trying to defeat the mailbox first. They are trying to enter the approval chain through a trusted business relationship, which means procurement, finance, and operations controls now sit on the same defensive plane as email filtering.

Vendor-behaviour monitoring should become a standard control concept. The useful signal is not just whether a message was authenticated, but whether its cadence, device context, and request pattern match the normal relationship. That shifts defenders away from static indicators and toward relationship-aware detection that can catch subtle abuse before money or data moves.

For practitioners

• Tighten vendor payment verification Require out-of-band confirmation for bank detail changes, urgent invoices, and account-update requests before any payment workflow proceeds.
• Map high-risk vendor workflows Identify which finance, sales, and operations processes depend on rapid external replies, then add approval steps where vendor requests can trigger movement of money or data.
• Add vendor-behaviour monitoring Detect changes in sender cadence, login context, reply-chain history, and transaction language so that unusual vendor communications are reviewed before action is taken.
• Treat repeat engagement as a control failure Track users and teams that have previously engaged with VEC and apply additional scrutiny to subsequent vendor requests from the same relationships.

Key takeaways

• Vendor email compromise succeeds because it weaponises trust embedded in normal business relationships, not because it needs malware or obvious phishing artefacts.
• The article shows that 44% of employees engage with VEC attacks overall and that only 1.46% are reported, which helps explain why the problem persists.
• The control gap is behavioural rather than purely technical, so organisations need stronger vendor verification, workflow approval, and relationship-aware monitoring.

Key terms

• Vendor Email Compromise: Vendor email compromise is a form of impersonation that targets supplier, contractor, or partner relationships. Attackers exploit routine vendor communication patterns to request payment changes, invoice redirection, or other sensitive actions, so identity and process verification must extend beyond internal users.
• Behavioural email detection: A detection approach that looks for patterns in sender behaviour, message timing, language change, and downstream user interaction rather than relying only on signatures. It is designed to catch attacks that mutate quickly. For identity programmes, its value is in finding the moment an email becomes an access risk.
• Trust Boundary: A trust boundary is the point where one system’s authority should stop and another system’s authority should begin. For internal automation, weak trust boundaries let monitoring, remediation, and execution share privileges that should have remained separate.
• Vendor Impersonation: Vendor impersonation is a fraud pattern where an attacker or dishonest actor pretends to be a supplier in order to change payment details or redirect funds. The control weakness is usually weak verification, not just a bad email, because the organisation failed to confirm the change through a trusted channel.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.