How can organisations reduce the risk posed by Very Attacked Persons and heavily targeted email lists?

Why targeted treatment beats broad awareness alone

Very Attacked Persons, and the email lists they sit on, are not just a training problem. They are a concentration problem: one user or one distribution list can attract repeated phishing, impersonation, and follow-on compromise attempts because the expected payoff is higher. The 52 NHI Breaches Report is useful here because it reinforces a simple operational point: once an actor or address becomes a reliable target, attackers keep testing the weakest path into it.

The right response is to move from generic messaging to exposure-based controls. High-risk people need stronger verification habits, faster reporting paths, and tighter technical guardrails than the average employee. Shared lists need particular care because they often amplify reach, create predictable targeting surfaces, and expose many recipients to the same lure at once.

Which controls reduce exposure fastest?

The fastest risk reduction usually comes from a small set of controls that lower both compromise probability and blast radius. Targeted awareness helps where the attack is social engineering, but it is most effective when it is paired with protective controls such as browser isolation, stricter link handling, and stronger monitoring for suspicious mailbox activity. Those controls matter because the objective is not only to stop the first click, but to prevent a successful phish from turning into account abuse or lateral targeting.

For heavily targeted lists, the most valuable control is often segmentation of who receives what. If a list exists for convenience rather than necessity, reduce its membership, replace it with role-based distribution, or split high-exposure recipients into smaller groups so one lure does not reach every sensitive person at once. Where a list must stay broad, apply stricter inspection and monitoring to the list path itself, not just to individual inboxes.

How teams should operationalise high-risk user protection

Security teams should treat high-risk users as a distinct monitoring population with tighter alert thresholds and faster response routes. That usually means watching for anomalous sign-in behaviour, unusual forwarding rules, mailbox rule creation, suspicious consent grants, and repeated delivery of the same lure theme to the same people. The practical aim is to detect the campaign early enough that one exposed inbox does not become a repeatable access vector.

High-risk user protection works best when it is continuous, not ad hoc. Review the list of very attacked people regularly, update it when roles change or external visibility rises, and coordinate with executives, assistants, finance, legal, and communications teams because those functions are often disproportionately targeted. If a person is both highly visible and operationally privileged, treat them as a higher-consequence target even when they are not formally privileged in the IAM sense.

Risk and Threat Considerations

Heavily targeted users and lists create concentrated exposure: attackers can repeatedly probe the same person, adapt their lure, and use one successful compromise to reach other accounts, sensitive mail, or trusted contacts. Shared lists also widen the blast radius, because a single malicious message can reach many people with similar trust assumptions.

Failure mechanism: repeated targeting increases the chance that one message, one credential prompt, or one impersonation attempt eventually succeeds, especially when users share similar approval habits or receive the same message through a broadly distributed list.

Impact: the result can be account takeover, business email compromise, fraud, mailbox abuse, and downstream targeting of colleagues or external partners through trusted communication channels.

Practitioner Guidance

What to prioritise: Start with the few people and lists that combine visibility, authority, and repeated targeting. A smaller set of stronger controls applied early usually beats a broad campaign applied evenly to everyone.

What to verify: Confirm whether the targeted population is actually receiving stronger filtering, faster incident triage, and a distinct reporting path. If the answer is no, the organisation has identified the risk but not materially reduced it.

What good looks like: high-risk users are reviewed on a schedule, their mail paths are monitored for abuse patterns, and shared lists are constrained so one compromised recipient cannot easily turn into many compromised recipients.

Practitioner takeaway: The key judgment is to treat exposure concentration as the risk, then apply controls that reduce both the probability of compromise and the amount of damage one successful phish can create.

Related resources from NHI Mgmt Group

• How should news organisations reduce the risk of targeted email and social account compromise when journalists are singled out by state-backed attackers?
• When should organisations treat an NHI as a high-priority risk?
• How can organisations reduce the blast radius of compromised agent identities?
• How should teams reduce the risk from overprivileged NHIs?