Topic starter
24/10/2026 8:52 pm
TL;DR: Manufacturing keeps drawing phishing and invoice fraud through Microsoft 365 Direct Send abuse, according to IRONSCALES. Direct Send leaves mail controls unable to separate authenticated traffic from genuinely trusted internal or supplier messages, so behaviour checks have to carry more weight.
Editorial analysis by NHI Mgmt Group, based on content published by IRONSCALES: “Why Attackers Target Manufacturers, and What the Attacks Look Like”.
By the numbers:
- Manufacturing accounts for 27.7% of incidents in IBM's 2026 X-Force Threat Intelligence Index.
- Business email compromise cost victims $3.04 billion in reported losses in 2025, per the FBI's IC3 annual report cited by IRONSCALES.
Key questions
A: They create immediate access to real conversations, vendor relationships, and financial context.
Q: What are the signs that vendor impersonation is succeeding even when authentication passes?
A: Look for payment-change requests, urgent invoice revisions, or banking updates from senders that are technically authenticated but inconsistent with normal supplier behaviour.
Q: What breaks when Direct Send is left open in Microsoft 365?
A: When Direct Send remains open, unauthenticated mail can enter the tenant looking like internal or trusted partner traffic.
Practitioner guidance
- Disable unauthenticated Direct Send where feasible Turn on RejectDirectSend and verify which devices or applications actually depend on the feature before leaving it enabled.
- Enforce DMARC on your own and supplier domains Move internal domains to enforcement and push key suppliers toward the same posture so spoofed or lookalike domains lose value.
- Monitor behaviour for authenticated but suspicious mail Build detections for mail that passes SPF, DKIM, and DMARC yet arrives with abnormal sender behaviour, unusual volume, or a role that should not be generating human-like requests.
Bottom line: Manufacturing email defence fails when teams rely on technical message validity alone, because authenticated mail can still carry fraudulent intent.
Glossary terms: Direct Send, Vendor Email Compromise, Invoice Fraud, Behavioural email detection
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
25/10/2026 11:12 am
Manufacturing phishing persists because business authenticity and technical authenticity are not the same control. The article shows that SPF, DKIM, and DMARC can all pass while the request is still fraudulent, which is the key governance failure in supplier-heavy environments. The control gap is not message validation alone but validation of whether the sender and request belong in the business process at all. Practitioners should treat payment workflows as identity and authorization problems, not just email-security problems.
A question worth separating out:
Q: How should organisations govern supplier mail when it becomes part of the access path?
A: Treat supplier mail as a governed access path, not as ordinary correspondence. That means defining who can request changes, how those requests are verified, and what happens when a supplier account is compromised. The control boundary has to extend beyond the inbox into business approval and third-party identity governance.
👉 Read our full editorial: Manufacturing phishing is rising as Direct Send abuse persists
This post was modified 6 days ago by NHI Mgmt Group