Topic starter
27/06/2026 1:44 pm
TL;DR: Business email compromise is only 11% of attack volume but averages $123,005 per incident, according to the FBI IC3, and Abnormal AI’s 2026 Attack Landscape Report shows that internal impersonation and lateral compromise shift sharply as organizations grow. The data shows BEC risk is shaped less by volume than by identity structure and workflow credibility.
Editorial analysis by NHI Mgmt Group, based on content published by Abnormal AI: “2026 Attack Landscape Report: BEC Tactics Adapt to Your Operations”.
By the numbers:
- Business email compromise represents roughly 11% of attacks by volume, versus phishing's 58%.
- VIP impersonation drops from 43% to 7% of named-identity BEC as organization size grows.
- Lateral BEC hits 23.2% of all BEC at large enterprises but just 0.24% at small organizations.
Key questions
Q: What breaks when BEC defenders focus only on executive impersonation?
A: They miss the shift to employee impersonation and compromised internal accounts that becomes more common as organisations scale.
Q: Why does BEC get harder to spot inside larger organisations?
A: Larger organisations create more legitimate senders, more approval chains, and more normal internal traffic for attackers to blend into.
Q: How do security teams know whether BEC controls are actually working?
A: Look for fewer successful fraudulent approvals, faster reporting of suspicious requests, and lower dependence on email content alone for decision-making.
Practitioner guidance
- Map internal trust paths by role and workflow Identify which messages finance, IT, HR, and executive teams treat as routine, then pinpoint where a named sender or department label is enough to trigger action.
- Separate mailbox authentication from trust validation Require additional checks for requests that move money, reset access, or change approvals, even when they come from a legitimate internal address.
- Reduce exposure to peer-level impersonation Review which colleagues, managers, and support teams are most likely to be trusted without challenge, then tighten verification for those communication paths.
Bottom line: BEC is a low-volume but high-cost attack pattern, and its credibility changes with organisation size and internal structure.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
27/06/2026 3:10 pm
Internal trust, not just identity spoofing, is the real attack surface in BEC: The report shows that attackers do not rely on a single impersonation style. They change targets and pretexts as organisations scale, because credibility is shaped by how work actually moves through the business. The practitioner lesson is that trust boundaries need to be mapped around workflow, not org chart alone.
A few things that frame the scale:
- Businesses report a 200% surge in attempted deepfake-aided wire fraud in Q1 2025 alone.
A question worth separating out:
Q: What should teams do when a legitimate internal account is used in a fraud attempt?
A: Treat it as a trust-channel compromise, not only a user-account issue. Contain the mailbox, review recent messages and forwarding rules, identify any approvals or transfers triggered by the account, and reset the surrounding assumptions about which internal senders can be trusted without challenge.
👉 Read our full editorial: Business email compromise shifts with org size and internal trust