The email account is still the weakest link in the C-suite

Executive security conversations tend to gravitate towards the sophisticated end of the threat spectrum. Nation-state actors, supply chain compromise, AI-enabled intrusion. Meanwhile, the losses that actually land on the balance sheet arrive through a channel every leadership team has used since the nineties, and they arrive because a request looked exactly like the hundreds of legitimate requests that came before it.

Business email compromise works by exploiting process rather than technology. Someone with authority receives a message that matches the tone, timing and vocabulary of a real relationship, and acts on it inside a process designed for speed. The attacker never breaks anything. They simply borrow a voice the organisation already trusts, and the internal controls perform exactly as designed while the money leaves.

The numbers keep email on the agenda

The FBI’s Internet Crime Complaint Center reported more than $16 billion in losses across its most recent full reporting year, a 33% rise on the prior period, with phishing and spoofing the highest-volume complaint category. Those are reported losses only, which means the real figure is higher.

For a mid-market company, a single successful fraudulent payment request can exceed an entire year of security spend. That maths tends to concentrate attention faster than any threat briefing.

Why executives are the specific target

Seniority is the vulnerability. A message that appears to come from a chief executive travels through an organisation with a following wind, because questioning it carries social cost. The finance manager who pauses a payment to verify it is doing exactly the right thing and knows it may look obstructive.

Executive email addresses are also unusually exposed. They appear in press releases, investor materials, conference programmes and regulatory filings. The writing style is often public too, which makes convincing impersonation straightforward. Delegated mailbox access widens the surface further, since a request aimed at an executive is frequently actioned by an assistant who never speaks to them directly about it.

Controls that survive a bad Friday afternoon

Three things do most of the work. Verify payment changes out of band, using a number already on file rather than one in the message. Give staff explicit, stated authority to delay any payment while they check, and mean it. And treat every email account with financial authority as a critical system, with multi-factor authentication, monitored access and a defined response if something looks wrong.

The cultural piece matters as much as the technical one. Organisations where reporting a mistake is embarrassing find out about incidents days later. The gap between the click and the disclosure is where recoverable losses become permanent ones.

The wider data question

This sits inside a larger shift in how much personal and behavioural information organisations now hold, a subject explored in the rise of human digital twins and the governance questions that come with it. The more an organisation knows about its people, the more useful its correspondence becomes to anyone who gets inside it.

Leadership teams reviewing cyber posture usually ask what new capability they should buy. The better question is narrower. Who can authorise a payment, what would they need to see to believe a request, and how quickly would anyone notice if they were wrong?

Answer those honestly and the largest single category of financial cyber loss becomes considerably harder to execute.