Topic starter
27/06/2026 1:44 pm
TL;DR: Vendor email compromise now makes up 61% of business email compromise, while billing account update requests carry a 26.5% compromise rate, showing attackers are optimising for trusted relationships and financial workflow disruption, according to Abnormal AI’s 2026 Attack Landscape Report. The lesson is that identity governance has to extend beyond users to the approval chains and vendor relationships that BEC exploits.
Editorial analysis by NHI Mgmt Group, based on content published by Abnormal AI: “Abnormal AI 2026 Attack Landscape Report: Threat Actors Move Beyond Technical Exploits to Target Human Behavior and Trusted Relationships”.
By the numbers:
- 61% of business email compromise is now vendor-related, according to Abnormal AI.
- More than one in five phishing attacks, or 21.6%, now use redirect chains, according to Abnormal AI.
Key questions
Q: What breaks when vendor payment-change requests are handled like normal invoices?
A: The organisation collapses a high-risk identity event into a routine operational one.
Q: Why do vendor fraud and impersonation attacks bypass legacy email defenses?
A: They bypass legacy defenses because those controls rely on signatures, known bad patterns, and repetitive indicators.
Q: How should security teams govern billing account update requests?
A: Treat them as privileged business actions with separate approval, independent verification, and clear exception handling.
Practitioner guidance
- Tighten vendor change verification Require out-of-band confirmation for any vendor request that changes billing details, bank instructions, or payment routing.
- Reclassify payment changes as privileged events Treat billing account updates as high-risk workflow steps with explicit approval, documented evidence, and exception review.
- Map vendor approval chains end to end Document who can initiate, review, and authorise vendor-related financial changes, then identify where identity proof is expected, where it is assumed, and where it is missing.
Bottom line: Vendor email compromise now targets the trust layer of business operations, not just user inboxes or obvious phishing lures.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
27/06/2026 3:10 pm
Vendor email compromise has become a governance problem, not just an inbox problem. When 61% of BEC is vendor-related, the attacker is abusing the credibility of a business relationship rather than merely spoofing a sender. That means the control failure sits in how organisations recognise, verify, and authorise external requests. Practitioners need to treat vendor trust as an identity asset with lifecycle controls, not an assumption baked into finance operations.
A question worth separating out:
Q: What role should finance and IAM teams each play in vendor email compromise prevention?
A: Finance owns the workflow and approval discipline, while IAM owns identity evidence, external account validation, and access trust assumptions. The best protection comes when both teams share one control model for vendor contact changes, payment updates, and exception review.
👉 Read our full editorial: Vendor email compromise is reshaping BEC and finance workflows