VAPs

What VAPs Mean in Practice

VAPs, or very attacked people, are not just a labelled audience segment, they describe a security reality in which certain users attract outsized phishing, impersonation, and account-abuse pressure. The value of the term is operational: it helps teams stop treating all users as equally targeted and instead recognise where attacker attention is likely to concentrate.

In most organisations, the “very attacked” population is shaped by role, visibility, and trust relationships. Executives, finance teams, executive assistants, legal staff, and employees who can move money or approve changes are often attractive because compromise of one account can create a fast path to fraud or lateral access.

Why VAPs Attract Disproportionate Attention

Attackers focus on VAPs because these users often have broad communication reach, frequent external contact, and enough privilege or influence to make social engineering work. A single successful message can be more valuable than dozens of low-quality attempts against ordinary inboxes.

The term also reflects a targeting pattern, not a fixed title list. A person becomes “very attacked” when their role, relationships, or access make them a repeated target, and that can change as an organisation grows, reorganises, or becomes visible in a new transaction flow.

This matters because the attack surface is as much about human workflow as it is about technology. A user who can approve payments, reset access, or influence vendors may be targeted through email, collaboration tools, voice calls, or identity takeover attempts that exploit trust rather than software flaws.

How Organisations Identify and Prioritise VAPs

Identifying VAPs usually starts with combining role knowledge, business process understanding, and incident history. Security teams look for patterns such as repeated phishing against the same users, prior account takeover attempts, executives with public profiles, and staff whose actions can trigger financial or operational impact.

The practical point is to prioritise by likely attacker interest, not by seniority alone. A less visible employee with payment authority, customer-data access, or trusted vendor contact may be more exposed than a higher-ranking role that is less reachable or less useful to abuse.

Good identification also depends on keeping the list current. As responsibilities shift, new external relationships appear, or a person gains access to sensitive workflows, the level of targeting risk can change quickly.

Controls That Matter Most for VAPs

VAPs benefit from layered controls because no single measure stops every attack path. Strong authentication, tighter session protection, phishing-resistant sign-in, heightened alerting, and more sceptical handling of payment or access requests all reduce the chance that a successful lure becomes a compromise.

Communication controls matter too. When a user is likely to be impersonated, organisations should reduce ambiguity in approval flows, verify high-risk requests through a second channel, and make unusual requests easier to challenge without slowing legitimate work too much.

Training is still useful, but for VAPs it should be role-specific and scenario-driven. Generic awareness content is usually less effective than targeted exercises that reflect the exact fraud, impersonation, and account-abuse tactics those users are most likely to face.

Risk and Threat Considerations

VAP targeting raises the likelihood of successful credential theft, message interception, fraudulent payments, and downstream account abuse because attackers concentrate on users who can unlock more value per compromise. The risk is not only initial phishing success, but also the speed with which a compromised high-trust account can be used for impersonation or follow-on abuse.

Failure mechanism: An attacker uses social engineering, spoofed correspondence, or compromised accounts to exploit trust, obtain credentials or approve actions, and then pivots into fraud, internal access, or further impersonation.

Impact: The result can be financial loss, business-email compromise, unauthorised changes, reputational harm, and a wider security incident if the compromised user can influence others or access sensitive workflows.

Practitioner Guidance

Why practitioners should care: VAPs are a prioritisation tool, not a status label. The term is most useful when it drives sharper monitoring, better workflow verification, and more realistic phishing resistance for the users attackers care about most.

What to watch for: Repeated targeting, unusual login prompts, sudden changes in communication patterns, and high-risk requests that appear to come from trusted leaders or business partners. These signals often show that an account is being singled out rather than casually probed.

Practitioner takeaway: Treat VAPs as a dynamic risk population, and keep the list tied to actual targeting patterns and business impact rather than org chart rank alone.