Security Awareness for Executives and Assistants

Executives and the assistants who run their inboxes, calendars and travel are targeted more precisely than anyone else in the organisation, yet they usually receive the same generic awareness module as everyone else, or are excused from it. Attackers research senior people from public sources, impersonate them to finance teams, and target their personal accounts and families because those are less protected than corporate systems. This guide sets out an awareness programme designed for that group: the threats that actually reach executives and executive assistants, the delegation and verification habits that stop them, travel and family exposure, how to brief busy people in a format they will accept, and how to measure the result. It is written for awareness leads, CISOs and executive office managers. Device hardening for the same group is covered in the Executive and VIP Device Protection Guide, and the wider programme in the Security Awareness and Human Risk Management Guide.

Key takeaways

Treat the executive and the assistant as one unit. The assistant often holds Full Access or Send As rights to the executive's mailbox, so an attacker who compromises the assistant can act as the executive with no visible sign.
Verification beats recognition. In the Arup case a finance worker saw and heard convincing fakes of senior colleagues on a video call; only an out-of-band check against a known number would have stopped the transfers.
Personal accounts are part of the attack surface. The NCSC warns that personal accounts and devices may be easier targets than work systems, and advises applying the same protections to them.
Briefings must be short, personal and repeated. Executives respond to a 20-minute session using their own public footprint and real lures, not to a generic annual course.
Measure behaviour, not completion. Track reporting of suspicious contact, use of verification procedures and delegate access hygiene rather than course completion.

Why executives and assistants need their own programme

Senior people combine three things attackers want: authority to approve payments and exceptions, access to sensitive information, and a public profile that makes research easy. Microsoft describes priority accounts, such as CEOs, CFOs and CISOs, as users whose compromise would be especially damaging and who attract spear phishing and whaling because the reward is greater. The NCSC guidance for high-risk individuals makes the same point about people whose work gives them access to sensitive information.

Threat	How it reaches the executive office	ATT&CK reference	Awareness behaviour that counters it
Reconnaissance from public sources	Biographies, interviews, conference videos, family posts and organisation charts used to build pretexts and voice or video clones	T1593.001 Social Media; T1591.004 Identify Roles; T1589 Gather Victim Identity Information	Review personal footprint; share less about travel and family in real time
Whaling and spearphishing	Tailored emails about board papers, legal matters, deals or awards	T1566.001, T1566.002	Report anything unexpected that creates urgency or secrecy, even if it looks internal
Executive impersonation to others	Fake requests from the CEO or CFO to finance, HR or the assistant (business email compromise)	T1534 Internal Spearphishing (after compromise); T1598 Phishing for Information	Executives tell staff in advance how they will and will not make requests
Voice and video deepfakes	Cloned voice calls or pre-recorded video meetings requesting transfers or credentials	T1566.004 Spearphishing Voice	Call back on a known number; use agreed verification phrases
Mailbox takeover and silent rules	Compromised account used to read deal mail and hide replies with inbox rules	T1114.003 Email Forwarding Rule	Report odd sign-in prompts; assistants check for rules they did not create
MFA prompt bombing	Repeated push prompts during travel or late at night	T1621 Multi-Factor Authentication Request Generation	Never approve a prompt you did not start; report it

The scale of impersonation fraud is well documented: the FBI's Internet Crime Complaint Center reported 305,033 business email compromise incidents worldwide with $55,499,915,582 in exposed losses between October 2013 and December 2023 (IC3 public service announcement I-091124-PSA, 11 September 2024). See the Executive Deepfake and CEO Fraud Guide.

The executive assistant: delegation done safely

Executive assistants (EAs) are usually the most targeted and least protected people in the executive office. They hold delegated access, manage travel and are expected to act quickly on the executive's behalf. In Microsoft Exchange Online the three common delegate permissions behave very differently, and both the EA and the executive should understand them.

Permission	What the delegate can do	Risk if the delegate is compromised	Awareness point
Full Access	Open the mailbox and view, add and remove content (but not send)	Attacker reads everything, including board and deal mail	Grant only where reading is needed; review quarterly
Send As	Send mail that appears to come directly from the executive, with no indication of the delegate	Attacker sends fully convincing mail as the executive	Prefer Send on Behalf so recipients can see who sent it
Send on Behalf	Send mail shown as "Delegate on behalf of Executive"	Attacker sends as the EA on behalf of the executive, which is visible	Teach finance to notice and question on-behalf payment requests
Calendar delegate	Manage meetings and see private details depending on settings	Attacker learns travel, meetings and absences	Hide private items; avoid detailed travel notes in invites

Delegate list ownership: the executive office manager owns the list of who holds which rights, and IT verifies it with Get-MailboxPermission, Get-RecipientPermission and the mailbox's GrantSendOnBehalfTo value at least [quarterly].
Temporary cover: cover assistants receive time-limited rights with an end date, not permanent membership of an "executive assistants" group.
Same protection as the executive: anyone with delegated rights should be in the same protected tier, for example tagged as a priority account in Microsoft Defender for Office 365 with the Strict preset security policy and legacy authentication disabled.
Assistant as gatekeeper: EAs are trained to be the first verification point: they confirm unusual requests with the executive in person or on a known number before acting, and are explicitly authorised to delay a request that cannot be verified.

Delegation is an identity question as much as an awareness one: delegated rights, shared mailboxes and connected scheduling or AI assistant apps are access grants that need owners and reviews. See the Exchange Online Security Guide.

Verification procedures executives must model

Awareness for executives is less about spotting phishing and more about agreeing, and visibly following, rules that make impersonation useless.

Publish how you will not ask: each executive states to finance, HR, the EA and direct reports that they will never request payments, gift cards, credentials or changes to bank details by message, call or video alone.
Call back on a known number: any unusual request is verified using a number from the directory or a pre-registered list, never one supplied in the request. The IC3 advice is to verify requests to change account information through a secondary channel.
Agree a verification phrase for the executive office: a shared phrase or question known only to the executive, EA and a few named people, changed after any suspected exposure.
Respect the control even when it is inconvenient: when an executive is challenged by finance to verify a genuine request, they thank the person publicly. Nothing undermines dual approval faster than a senior person overriding it.
Treat secrecy and urgency as warning signs: "keep this confidential, it is an acquisition" is a classic pretext. Train finance to escalate, not comply.

See the Business Email Compromise Awareness for Finance Teams Guide and the Deepfake CEO Fraud Response Playbook.

Personal accounts, family and public footprint

Attackers do not stop at the corporate boundary. The NCSC advises high-risk individuals to protect personal email, social media and banking with strong unique passwords and two-step verification using an authenticator app, to limit personal information shared publicly, to avoid accepting message requests from unknown accounts and to verify unknown contacts by calling first.

Personal email recovery: the recovery address and phone number for personal accounts are often the weakest link. Brief executives to check them and to remove old numbers.
Household exposure: partners and children post holidays, school names and home details in real time. A short family session, offered not imposed, covers delayed posting, location sharing and how to report a suspicious contact.
Footprint review: once a year, review what is public about each executive (home address in company filings or property records where these are public, personal phone numbers, travel patterns). See the Executive Protection and Digital Footprint Guide and the Doxxing Prevention Guide.
Report from personal devices too: the NCSC advice is to report to your organisation's IT support even if the incident happened on a personal device, and to report suspicious messages even if you did not click.

Travel and events

Executives travel more than most staff, attend public events and are photographed and recorded. Travel awareness for this group should be a one-page brief sent by the EA with the itinerary, not a course.

Situation	Brief content
High-risk destinations	Use a travel device set where policy requires; do not connect personal devices to corporate resources there; assume hotel and conference networks are monitored
Conferences and media	Badge photos and stage recordings provide voice and face samples; expect follow-up impersonation attempts after major appearances
Itinerary handling	Share travel details only with those who need them; avoid posting location in real time
Lost or seized device	Who to call, at any hour, and that reporting fast matters more than embarrassment
Unexpected MFA prompts abroad	Never approve; report immediately, as a prompt while travelling may be an attacker's attempt timed to fatigue

For the general traveller checklist, see the Travel Cybersecurity Guide. CISA has published mobile communications guidance aimed at highly targeted individuals such as senior government and political officials, and its principles apply to senior private sector leaders too.

Designing the briefing programme

NIST SP 800-50 Rev. 1 (September 2024) describes a life-cycle approach to cybersecurity learning programmes with role-based content; NIST CSF 2.0 outcome PR.AT-02 calls for individuals in specialised roles to receive awareness and training relevant to their tasks. Executives are such a role. The UK Cyber Governance Code of Practice also expects board members to build their own cyber understanding (Principle C).

Format	Audience	Length and frequency	Content
Personal threat briefing	Each executive, with EA	20 to 30 minutes, annually and on appointment	Their own public footprint, real lures sent to the organisation, verification rules, delegate rights
EA working session	All executive assistants	60 minutes, twice a year	Delegation, inbox rule checks, verification, travel handling, reporting
Board session	Board and executive committee	30 minutes, annually	Threats to the organisation and to directors personally; how to report
Targeted alerts	Executives and EAs	As needed	Short notes when a campaign or impersonation attempt is seen against the organisation
Simulation (optional)	Executives and EAs, by agreement	[Twice a year]	Tailored pretexts agreed with the executive sponsor; no-blame feedback

Get a sponsor: the CEO or chair asks for the briefings; otherwise diaries never open.
Use real material: anonymised lures that actually reached the organisation are more persuasive than vendor examples.
Be careful with simulation: agree with the sponsor and HR in advance what will be simulated (for example a fake board paper request), and never impersonate a real family member or use personal tragedy as a pretext.

Detection and measurement

Awareness for this group should be backed by monitoring that catches what training misses.

Mailbox audit events: Microsoft Purview mailbox auditing logs MailItemsAccessed, SendAs and SendOnBehalf for delegates, and UpdateInboxRules and UpdateFolderPermissions, by default. Alert on new inbox rules and permission changes on protected-tier mailboxes.
Priority account views: where the priority account tag is used, filter alerts, incidents and threat reports by it, so attempts against executives are seen quickly.
Sign-in signals: legacy authentication attempts, impossible travel and repeated MFA prompts on executive and EA accounts.
Impersonation reports: lookalike domains and display-name impersonation of executives in inbound mail.

Metric	Target direction
Executives and EAs briefed in the last 12 months	100%
Suspicious contacts reported by executives and EAs per quarter	Rising at first, then stable
Delegate rights reviewed on schedule, with unexplained rights removed	100% reviewed
Unusual payment requests verified by callback before action	100%
Executive and EA accounts with phishing-resistant MFA and legacy authentication disabled	100%
Time from a reported executive impersonation to a warning to finance and staff	Falling, target under [4] hours

Framework mapping

Framework	Reference	Relevance
NIST CSF 2.0	PR.AT-01, PR.AT-02	General and role-based awareness
NIST SP 800-53 Rev. 5	AT-2, AT-3, AC-6, AU-6	Awareness, role-based training, least privilege for delegates, audit review
MITRE ATT&CK v20	M1017 User Training; T1566, T1598, T1114.003, T1621	Mitigation and the techniques it targets
UK Cyber Governance Code of Practice	Principle C	Board members build their own cyber understanding; culture and awareness metrics

Common failure patterns

Executives excused from training: the most targeted people receive the least preparation, and their exemption signals that the rules are optional.
Recognition treated as verification: a familiar face or voice is taken as proof. The Arup deepfake fraud led to 15 transfers totalling HK$200 million after a video call in which every other participant was fake.
Delegate rights that never expire: former assistants and cover staff keep Full Access or Send As for years, unnoticed.
Forgotten accounts around senior mailboxes: in the Microsoft Midnight Blizzard breach a password spray against a legacy test tenant account without MFA led, through an OAuth application, to access to senior leadership mailboxes. Awareness alone does not fix this, but it shows why the executive tier needs technical protection behind the training.
Executives overriding controls: a senior person pressures finance to skip verification "just this once", teaching staff that real requests look exactly like fraudulent ones.
Generic content: the same e-learning as everyone else, with no mention of delegation, family or travel, so executives conclude it does not apply to them.

Practitioner checklist

Define the protected tier: executives, board members, their assistants and anyone with delegated rights to their mailboxes or calendars.
Run a personal threat briefing for each executive and EA, using their own public footprint and real lures.
Get every executive to state, in writing to finance and HR, how they will never make requests.
Set up callback verification on known numbers and a verification phrase for the executive office.
Review Full Access, Send As and Send on Behalf rights quarterly and prefer Send on Behalf over Send As.
Apply the same technical protections to EAs as to executives, including priority account tagging where available.
Offer an optional family session and an annual footprint review.
Send a one-page travel brief with each itinerary for high-risk trips and events.
Alert on inbox rule and permission changes on protected-tier mailboxes.
Report reporting rates, verification use and delegate hygiene to the executive sponsor.

Security Awareness for Executives and Assistants Guide: Whaling, Delegation, Travel and Family