Topic starter
24/10/2026 8:51 pm
TL;DR: A read-only Keelings proof of concept caught a live CEO impersonation attack that the company’s secure email gateway had already let through, according to IRONSCALES. Executive impersonation now needs post-delivery checks that can judge intent and request context, not just message content.
Editorial analysis by NHI Mgmt Group, based on content published by IRONSCALES: “When a Read-Only POC Catches a Live CEO Impersonation Attack”.
By the numbers:
- Keelings monitored 3.5 million emails in the first 90 days of deployment.
- IRONSCALES automatically remediated 584 email attacks in the first 90 days.
- The platform caught 742 impersonation attempts through exact display-name matching.
Key questions
Q: Why do executive impersonation attacks create risk even when the mail gateway is working?
A: Because the gateway may be doing exactly what it was designed to do, while the attacker is exploiting a gap in its threat model.
Q: How do security teams know if email compromise detection is actually working?
A: Look for whether the programme detects suspicious sign-in locations, device mismatches, abnormal east-west traffic, and deviations in vendor or employee communication patterns before fraud occurs.
Q: What breaks when CEO impersonation messages contain no malicious link or attachment?
A: Content-scanning gateways lose most of their value when the attack is social rather than technical.
Practitioner guidance
- Strengthen executive impersonation detection Add behavioural and identity-aware checks for messages that reference senior staff, urgent requests, payment, or vouchers, especially when there is no malicious attachment or link.
- Run new controls in observe mode first Use read-only deployment to compare detections against your existing gateway before enabling remediation, so you can prove what the incumbent misses on live traffic.
- Review post-delivery inspection coverage Map where email analysis happens in the stack and confirm you can inspect delivered mail without introducing a new mail-flow hop or delivery failure point.
Bottom line: CEO impersonation is now a governance and fraud problem as much as an email security problem, because attackers can bypass content-based controls with clean-text requests.
Glossary terms: Business email compromise, Executive impersonation, Post-Delivery Email Inspection, Display Name Abuse
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 days ago by NHI Mgmt Group
25/10/2026 11:12 am
Clean-text impersonation is now a governance problem, not just a mail-filter problem. When attackers remove links and attachments, the control failure is not inspection depth but the assumption that malicious content must exist. That assumption no longer holds for business email compromise and executive impersonation, so identity-aware detection becomes part of email governance, not an optional add-on. Practitioners should measure controls against intent-based fraud, not only malware.
A few things that frame the scale:
- Impersonation fraud accounted for over 85% of all fraud attacks in 2025.
A question worth separating out:
A: They should add it when business email compromise, impersonation, or clean-text fraud is reaching users despite normal gateway filtering. Post-delivery inspection is most useful when the attack depends on trust and context rather than malware. It gives the defender a second chance to detect abuse after the message lands.
👉 Read our full editorial: Read-only email evaluation exposed a CEO impersonation gap
This post was modified 7 days ago by NHI Mgmt Group