Attack types
What is business email compromise?
Also called BEC.
An attack that impersonates a trusted person — usually an executive or a supplier — to trigger a payment or a data transfer.
In more detail
No malware, no attachment, often no link. Just a plausible message from a plausible sender, which is why technical controls catch so little of it and why it remains among the most costly categories of attack.
Why it matters
It targets process, not software. The control that works is a verification step nobody is allowed to skip.
Related terms
Voice phishing — phone calls impersonating IT support, an executive or a vendor.
A pre-built simulated phishing email that mimics a specific attack type, such as credential harvesting, business email compromise or brand impersonation.
The likelihood that everyday human behavior leads to a security incident.
Vocabulary is the easy part. Behavior is the job.
Thirty minutes, a live account, and a straight answer about where your people actually stand.