Topic starter
27/06/2026 1:44 pm
TL;DR: Vendor email compromise reaches employees at a 44% rate, third-party involvement in breaches doubled in 2024, and vendor fraud drove more than $51B in reported losses from 2013 to 2022, according to Abnormal AI and Verizon’s 2025 DBIR. The governance gap is not alert volume, it is weak visibility into vendor relationships and the trust assumptions built into business communications.
Editorial analysis by NHI Mgmt Group, based on content published by Abnormal AI: “Stopping Vendor Fraud with Continuous Risk Intelligence from VendorBase™”.
By the numbers:
- Employees engage with vendor email compromise attacks at a 44% rate, making them hard to detect and avoid.
- Third-party involvement in breaches doubled in 2024, according to Verizon’s 2025 DBIR cited by Abnormal AI.
- Vendor fraud drove over $51B in reported losses between 2013 and 2022.
Key questions
Q: What breaks when organisations cannot see which vendors are actively communicating with employees?
A: The trust boundary breaks first.
Q: Why do vendor email accounts create fraud risk?
A: Vendor email accounts matter because they can become trusted entry points into procurement and finance workflows.
Q: How should security teams measure whether supplier risk monitoring is actually working?
A: Look for evidence that monitoring changes decisions.
Practitioner guidance
- Map active vendor relationships Build a live inventory of vendors that includes contacts, domains, IPs, countries, and the internal users each vendor can reach.
- Score third-party risk continuously Use behavioural signals such as suspicious email patterns, compromise indicators, and impersonation attempts to update vendor risk in near real time.
- Validate payment and request flows Require a second verification path for vendor-driven payment changes, invoice requests, and sensitive data asks, especially when the message origin or context has changed.
Bottom line: Vendor email compromise succeeds by exploiting trusted business relationships, which turns routine communications into a fraud channel.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
27/06/2026 3:11 pm
Vendor email compromise is fundamentally a trust-boundary failure, not an inbox filtering problem. The article shows that attackers are not merely bypassing email controls, they are exploiting the authority embedded in vendor relationships. That shifts the governance question from message inspection to relationship visibility and verification. Security teams should treat vendor communications as a controlled identity channel, not an informal business exception.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Who should own vendor communication risk when the attack touches finance and procurement?
A: Shared ownership is usually required. Security needs the detection and visibility layer, but finance or procurement must own the business decision because they understand whether a vendor request is normal, urgent, or outside approved process.
👉 Read our full editorial: Vendor email compromise is exposing a major supply-chain blind spot