CEO impersonation attacks: what do email security teams miss?

TL;DR: A Keelings proof of concept in read-only mode caught a live CEO impersonation attack that the company’s secure email gateway had already let through, according to IRONSCALES, showing how business email compromise can bypass content-scanning defenses when messages contain no malicious link or attachment. The result is a stronger case for post-delivery, intent-based analysis alongside existing gateway controls.

Editorial analysis by NHI Mgmt Group, based on content published by IRONSCALES: “When a Read-Only POC Catches a Live CEO Impersonation Attack”.

By the numbers:

• Keelings monitored 3.5 million emails in the first 90 days of deployment.
• IRONSCALES automatically remediated 584 email attacks in the first 90 days.
• The platform caught 742 impersonation attempts through exact display-name matching.

Key questions

Q: What breaks when CEO impersonation messages contain no malicious link or attachment?

A: Content-scanning gateways lose most of their value when the attack is social rather than technical.

Q: Why do executive impersonation attacks create risk even when the mail gateway is working?

A: Because the gateway may be doing exactly what it was designed to do, while the attacker is exploiting a gap in its threat model.

Q: How do security teams know if email compromise detection is actually working?

A: Look for whether the programme detects suspicious sign-in locations, device mismatches, abnormal east-west traffic, and deviations in vendor or employee communication patterns before fraud occurs.

Practitioner guidance

• Strengthen executive impersonation detection Add behavioural and identity-aware checks for messages that reference senior staff, urgent requests, payment, or vouchers, especially when there is no malicious attachment or link.
• Run new controls in observe mode first Use read-only deployment to compare detections against your existing gateway before enabling remediation, so you can prove what the incumbent misses on live traffic.
• Review post-delivery inspection coverage Map where email analysis happens in the stack and confirm you can inspect delivered mail without introducing a new mail-flow hop or delivery failure point.

Bottom line: CEO impersonation is now a governance and fraud problem as much as an email security problem, because attackers can bypass content-based controls with clean-text requests.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →