What should organisations do when employees are the main target of cybercriminals?

Build controls for the most likely attack path, not the average user error

When employees are the main target, the right response is to design for compromise attempts, not to assume awareness alone will stop them. The practical question is where a mistaken click, reply, or approval would actually create impact, then place friction at those decision points: payments, bank detail changes, password resets, payroll updates, and shared admin requests.

That shifts the centre of gravity from generic caution to specific verification. Use out-of-band confirmation for high-risk changes, require a second approver where money or access is involved, and make exception handling explicit so staff do not improvise under pressure.

Well-designed controls should still leave employees able to work quickly, but remove the easy path from social engineering to loss. That usually means clear playbooks, simple checkpoints, and escalation routes that are faster than a fraudster’s message thread.

Make authentication resilient to phishing and session theft

Employee targeting often succeeds because attackers want to turn a single interaction into durable access. Strong passwords help less than many teams assume if credentials are phished, replayed, or reused, so phishing-resistant authentication and tighter session controls matter more than adding more prompts.

In practice, that means favouring strong authenticators, limiting legacy login paths, and treating account recovery as a high-risk workflow. If an attacker can bypass the first factor and then exploit weak recovery or token theft, awareness training has already been outrun.

Authentication should also fit the role and the risk. Privileged staff, finance users, and people who can approve access or payments usually need stronger checks and lower tolerance for unusual sign-in behaviour than low-risk routine users.

Shorten the time from suspicious contact to containment

Employee-targeted attacks become much more damaging when they are discovered late. The organisation needs a fast route from suspicion to containment, because the first report from an employee is often the best chance to stop fraud, inbox takeover, or lateral movement before it spreads.

That means staff must know exactly where to send a suspicious email, who can freeze an account, and what conditions trigger payment holds or credential resets. It also means security teams should be able to act on a report without waiting for perfect evidence.

CISA cyber threat advisories remain a useful external reference point for keeping staff-facing guidance aligned to current attack patterns, especially when the threat mix shifts toward phishing, impersonation, and business email compromise.

Risk and Threat Considerations

Employee targeting is dangerous because attackers often need only one successful message, one weak verification step, or one over-permissioned account to turn social engineering into financial loss or broader compromise. The real risk is not that every employee will fail, but that one failure can be enough when the surrounding controls are thin.

Failure mechanism: The attacker exploits urgency, trust, or routine business process, then uses credential theft, fraudulent approval, or account takeover to move from the employee to the business system.

Impact: The result can be payment diversion, mailbox compromise, unauthorised access, or a larger incident if the compromised account can approve changes, reset credentials, or reach sensitive systems.

Practitioner Guidance

What to prioritise: Start with the processes that can move money, reset access, or change supplier or bank details. Those are the points where human error becomes a direct loss event rather than a contained mistake.

What to verify: Make sure your verification step is truly independent of the same channel the attacker can control. If staff are asked to “just confirm by email,” the control is usually weaker than it looks.

What good looks like: Employees know how to report suspicious contact, finance and IT have clear escalation paths, and high-risk requests cannot be completed by a single person acting under pressure.

Practitioner takeaway: The objective is to make employee targeting expensive for the attacker and recoverable for the organisation, so that human error becomes a prompt for control activation rather than a direct route to compromise.

Related resources from NHI Mgmt Group

• What is the main risk when automation systems store ServiceNow credentials?
• How should retail security teams reduce business email compromise risk when employees are the main target?
• What happens when organisations treat cloud and internal access as a one-time authentication problem instead of an ongoing monitoring problem?
• Should organisations allow pull_request_target for automated dependency workflows?