CEO impersonation in Microsoft 365: are your controls keeping up?

TL;DR: CEO impersonation attacks still slip past native Microsoft 365 filters because attackers use lookalike domains, display-name spoofing, and behavioural mimicry rather than malicious links or attachments, according to IRONSCALES. The gap is not message volume but trust assumptions, which means mailbox intelligence, impersonation controls, and email authentication all have to work together.

Editorial analysis by NHI Mgmt Group, based on content published by IRONSCALES: “How to Stop CEO Impersonation in Microsoft 365 in 7 Steps (2026)”.

Key questions

Q: What breaks when executive impersonation is trusted inside normal workflows?

A: The break is not only fraud, but governance.

Q: Why do lookalike domains remain effective even when email authentication is in place?

A: Lookalike domains work because SPF, DKIM, and DMARC validate legitimacy for the domain being used, not for visually similar domains that attackers register themselves.

Q: What are the signs that impersonation protection is too narrow?

A: If only exact spoofing is blocked while first-time senders, executive display names, and partner-domain lookalikes still reach inboxes, the control set is too narrow.

Practitioner guidance

• Protect high-value executives first Add CEOs, CFOs, and other wire-transfer authorities to impersonation protection before expanding the policy to lower-risk users.
• Quarantine impersonation detections by default Set user impersonation, domain impersonation, and mailbox intelligence detections to quarantine so suspicious messages do not reach inboxes while analysts review them.
• Align SPF, DKIM, and DMARC records Publish and test authentication records with a quarantine or reject policy so exact-domain spoofing fails and attackers are forced into harder-to-execute impersonation techniques.

Bottom line: Executive impersonation succeeds by abusing identity trust and conversational urgency, not by carrying obvious malware.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →