Look for whether the programme detects suspicious sign-in locations, device mismatches, abnormal east-west traffic, and deviations in vendor or employee communication patterns before fraud occurs. If alerts only appear after a malicious attachment or known bad URL is seen, the control is still too dependent on legacy indicators.
What “working” means for email compromise detection
email compromise detection is working only if it sees the attack before the fraud completes, not just after a known-bad payload lands. The practical test is whether the control detects identity, device, traffic, and communication anomalies that are consistent with mailbox takeover, impersonation, or payment diversion, then surfaces them early enough to change the outcome.
That means the programme should be validating behavioral signals, not just signature hits. If the only detections come from malicious attachment rules, URL reputation, or other legacy indicators, the control may still miss the more common pre-fraud phase where an attacker logs in quietly, establishes persistence, and waits for the right transaction.
Teams should judge this against the MITRE D3FEND style of defensive thinking, where the question is which countermeasures interrupt the attack path, not whether one bad indicator was caught after the fact.
Which signals prove the control is seeing the right kind of abuse?
The strongest evidence is a spread of signals across the compromise path. Suspicious sign-in locations, unusual device fingerprints, impossible travel, mailbox rule changes, outbound forwarding, new OAuth grants, abnormal east-west traffic, and unusual sender-recipient relationships all point to detection that is watching for living-off-the-land abuse rather than only malware.
For business email compromise, the alert should also reflect how real fraud unfolds: a compromise often shows up first as authentication drift or communication pattern drift, then as payment or vendor manipulation. That is why a detection stack aligned to mailbox abuse is more useful than one that only reacts when a malicious attachment or URL is already known.
Practitioners can compare that coverage with the patterns discussed in NHIMG’s Email Identity and BEC Guide, which focuses on mailbox takeover, email impersonation, and payment verification controls, and with Microsoft verified publisher OAuth phishing 2022, which illustrates how mailbox access can be gained without obvious malicious attachments.
Correlation quality matters as much as raw alert volume. A useful programme ties together identity events, mailbox activity, and downstream business-risk signals so that one weak indicator can become a strong case when it appears in the right sequence.
How to tell whether the control is measuring prevention instead of just alerting
The most useful measure is whether the team can show that detections happen before irreversible action, such as payment approval, invoice redirection, or sensitive data exfiltration. A good control reduces the dwell time between suspicious access and containment, and it should do so consistently across executives, finance staff, vendors, and high-risk mailboxes.
Detection quality should also be tested against realistic adversary behavior. MITRE ATT&CK remains useful here because it helps teams map mailbox compromise, credential access, lateral movement, and persistence into observable detections rather than generic “suspicious email” buckets. Pairing that approach with operational guidance from the SANS Security Resources helps teams benchmark against incident-handling and detection-engineering practice.
Where the environment uses cloud email, OAuth abuse, or third-party integrations, the control should also be able to detect consent grants, token abuse, and mailbox access from unfamiliar services. That is especially important because modern compromise often bypasses message content entirely.
Risk and Threat Considerations
Email compromise detection fails when it is tuned to the last stage of the attack. That creates a false sense of coverage, while attackers use valid logins, trusted cloud apps, or internal-looking message patterns to stay below legacy detection thresholds.
Failure mechanism: The control is overdependent on malware or reputation signals, so mailbox takeover, OAuth abuse, and payment fraud progress through legitimate channels before anything triggers.
Impact: The organisation discovers compromise only after funds move, vendors are redirected, or sensitive correspondence is exposed, which increases loss, recovery cost, and incident scope.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1110 — Brute Force | Email compromise often begins with credential attacks that enable mailbox access. |
| T1078 — Valid Accounts | Compromised mailboxes usually involve legitimate logins that evade content-based detections. | |
| T1114 — Email Collection | Mailbox monitoring is central to detecting compromise and exfiltration from email systems. | |
| Recommendation — Map sign-in anomalies to credential-access tactics and hunt for takeover patterns. Detect unusual use of valid accounts across mailbox, identity, and payment workflows. Correlate mailbox access, forwarding, and collection activity for compromise indicators. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Review, Analysis, and Reporting | Behavioral email compromise detection depends on analyzing identity and mailbox audit trails. |
| IA-2 — Identification and Authentication (Organizational Users) | Suspicious sign-in locations and device mismatches are authentication signals in this question. | |
| SI-4 — System Monitoring | The question is fundamentally about whether monitoring detects compromise before fraud. | |
| Recommendation — Correlate sign-in, mailbox, and alert data to surface pre-fraud anomalies. Strengthen user authentication telemetry and flag impossible or high-risk logins. Instrument mailbox and identity monitoring for suspicious access and behavior changes. | ||
Practitioner Guidance
What to verify: Confirm that your detections include sign-in anomalies, mailbox rule changes, token or consent abuse, and abnormal conversation patterns, not just malicious attachment or URL hits. If you cannot show at least one pre-fraud detection path, the programme is still too shallow.
What to measure: Track the percentage of confirmed compromises first detected from behavioral or identity-based signals, and whether alerts arrive before fraud confirmation or exfiltration. That tells you whether the control is protecting business outcomes or merely documenting incidents after the fact.
Common mistake: Treating email security as a spam or malware problem. The real control question is whether you can see the account, device, and communication changes that precede abuse, then respond fast enough to interrupt the transaction.
Practitioner takeaway: Email compromise detection is working when it catches the attacker’s quiet access and behavioral drift early enough to stop payment diversion, mailbox persistence, or impersonation, not when it only identifies known-bad content.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 8, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org