Topic starter
27/06/2026 2:04 pm
TL;DR: Vendor email compromise drove 44% employee engagement overall and 72% in enterprises with more than 50,000 staff, while only 1.46% of attacks were reported and 7.3% of engagements came from repeat victims, according to Abnormal AI’s VEC threat report. Legacy email security misses the trust layer, which is now the real control boundary.
Editorial analysis by NHI Mgmt Group, based on content published by Abnormal AI: “Weaponized Trust: Vendor Impersonation Becomes a Top Threat”.
By the numbers:
- 44% of employees engage with VEC attacks overall, rising to 72% at enterprises with 50,000+ staff.
- Only 1.46% of VEC attacks are reported.
- 7.3% of engagements come from repeat victims.
Key questions
Q: What breaks when vendor emails pass SPF, DKIM, and DMARC but still lead to fraud?
A: Email authentication only proves that a message can be associated with a sending domain.
Q: Why do employees keep engaging with vendor impersonation attacks?
A: Employees often trust the request because it fits a real workflow and arrives from a familiar business context.
Q: What are the signs that a vendor email compromise campaign is bypassing normal email defenses?
A: Common warning signs include messages that arrive from a real vendor account but introduce subtle changes in tone, payment instructions, banking details, or attachment behavior.
Practitioner guidance
- Tighten vendor payment verification Require out-of-band confirmation for bank detail changes, urgent invoices, and account-update requests before any payment workflow proceeds.
- Map high-risk vendor workflows Identify which finance, sales, and operations processes depend on rapid external replies, then add approval steps where vendor requests can trigger movement of money or data.
- Add vendor-behaviour monitoring Detect changes in sender cadence, login context, reply-chain history, and transaction language so that unusual vendor communications are reviewed before action is taken.
Bottom line: Vendor email compromise succeeds because it weaponises trust embedded in normal business relationships, not because it needs malware or obvious phishing artefacts.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
27/06/2026 3:40 pm
Vendor email compromise exposes a trust-governance gap, not an email-delivery problem. SPF, DKIM, and DMARC only prove that a message fits a domain’s sending rules. They do not prove that the business request inside the message is legitimate, which is why legacy controls fail against vendor impersonation. The implication is that email security and vendor trust governance can no longer be separated.
A few things that frame the scale:
- Impersonation fraud accounted for over 85% of all fraud attacks in 2025.
A question worth separating out:
Q: Should organisations treat vendor trust checks differently from standard email security controls?
A: Yes. Standard email controls focus on message authenticity and known-bad content, while vendor trust checks focus on whether the request fits the established business relationship. Organisations need both, but the second layer is what stops routine-looking fraud in finance and operations workflows.
👉 Read our full editorial: Vendor email compromise exposes the limits of legacy email security