Defending the Enterprise: The Latest Trends and Tactics in BEC Attacks, conducted by Osterman Research, examined survey responses from around 250 U.S. IT and security professionals regarding BEC — a type of phishing attack with the goal of stealing money or critical information from an organisation by misleading its employees.

Among its key findings, the report explicitly underscores the growing anxiety surrounding BEC attempts, as threat actors leverage new channels to lay the foundations for successful — and potentially dire — BEC attacks. In the UK alone, BEC incidents cost firms £138 million in losses, according to Infosecurity Magazine.

Specifically, large organisations’ perceived threat of BEC attacks is set to increase by 43.3% over the next 12 months, the research found. This figure not only represents a year-on-year increase, but it’s also twice as high as the threat of phishing in general.

Large organisations, i.e. organisations with over 10,000 employees, have the most variables to control — and also the most to lose; from substantial sums of cash to highly-sensitive data, as well as intellectual property.

The report highlighted that the groups most targeted by BEC attacks are finance employees and C-level executives, due to their close proximity to company finances and the authority they wield.

The 43.3% spike in perceived threat is by no means unfounded, of course: 93% of organisations experienced one or more of the BEC attack variants over the last 12 months, with 62% facing three or more attacks over this time, the report disclosed.

Additionally, the most common variant of BEC attack was found to be fake invoices (20.2%), followed by data theft (19.7%), account takeover (18%), payroll diversion (12.7%), gift card scams (12.3%), CEO fraud (10.4%), and attorney impersonation (4.5%).

Further, new channels — or “precursors” — are being utilised to exploit unsuspecting employees and organisations. While spear phishing email messages remain the most frequent channel used (40% of respondents said these are used either “almost every time” or “every time”), it’s quickly followed by fraudulent SMS messages (36%), fraudulent connection requests on social media (27%), and fraudulent phone calls (22%).

Recommended

• What’s the Latest Data on the Scottish Tech Labour Market?
• IBM Women in Leadership: Perception Outpaces Reality
• DIGIT Movers and Shakers | February 2023

While organisations arm themselves with a slew of protective measures — including security awareness training, secure email gateways (SEGs), multi-factor authentication, and phishing simulation testing — the report suggests that many of these approaches have questionable efficacy.

For instance, security awareness training is generally offered too infrequently to be valuable, and while secure email gateways are indeed crucial for thwarting traditional phishing attacks by identifying malicious content, BEC attacks seek to weaponise intent rather than attachments or links.

So that organisations can be more robust in their defence against BEC attacks, one particular tool that the report advocates for is A.I.-powered anti-phishing tech.

While 55% of organisations are apparently already using such technology, its ability to identify malicious intent — which can be overlooked by SEGs — can be particularly advantageous. Additionally, the inherent continuous learning capabilities of contemporary A.I. anti-phishing tech means that its ability to detect advanced BEC threats is greatly improved.

“The findings of this report should leave no doubt as to the scope and severity of today’s business email compromise problem,” said Audian Paxson, Director of Technical Product Marketing at IRONSCALES.

“And yet, we find that many organisations remain ill-equipped to defend against this rising threat. The continued reliance on legacy email security solutions, such as SEGs, places organisations at significant risk.

“This report drives home the need for organizations to re-examine their approach to BEC security, by incorporating AI-enabled solutions that work in concert with regular phishing simulation testing and security awareness training. Employees should be part of the solution, not a liability.”