BEC cyber exercise

Business Email Compromise (BEC) is one of the most damaging forms of cybercrime for businesses. An attacker poses as someone your organisation trusts, often a director, manager or regular supplier, and uses that credibility to extract money or information. It happens to a lot of companies, and smaller and mid-sized businesses in particular turn out to be vulnerable.

The scenarios vary, but you probably recognise them:

• "Can you pay this invoice quickly? It's urgent." A rush payment that slips just outside the normal procedure.
• A changed account number on an otherwise legitimate invoice from a known supplier.
• A request to share confidential information or documents, seemingly from someone with authority.
• A compromised mailbox that follows ongoing conversations and strikes at exactly the right moment.

The end result is almost always the same: a payment that disappears to the wrong account, or sensitive data that ends up in the open.

From whitepaper to practice

The Dutch NCSC published a technical advisory on BEC that sets out exactly how these attacks generally unfold, phase by phase, from gathering information to the final financial theft. That whitepaper describes the techniques and the measures you can take against them.

That advisory did not come out of nowhere: the NCSC produced it together with several specialised security companies, including our own Attic Security. We helped write the very knowledge this exercise is based on, and we know these attacks from the inside rather than just from theory.

Reading a document is one thing. Knowing whether your organisation is actually resilient in practice is something else entirely. That is where our BEC cyber exercise comes in: we simulate a real incident and apply exactly those techniques in your own environment. We see how far we get, whether it is detected, and how your organisation responds.

Along the whole kill chain

The attack runs along a fixed kill chain, a sequence of phases an attacker goes through. Together with you we walk through those phases and look at how far we can find the techniques, vulnerabilities and weak spots in your processes. For each phase we test not only the technology, but also the human and procedural side: how does your organisation respond when something goes wrong?

Click a phase to see which techniques and measures belong to it in the technical advisory:

In concrete terms this means we:

• replicate the techniques from the BEC advisory in a controlled way in your Microsoft 365 environment;
• test whether your defences detect the attack, and at which point in the kill chain;
• look at how your incident response works in practice, from first signal to follow-up;
• map the weak spots in both technology and processes;
• give you a concrete picture of where your resilience falls short and what is needed to improve it.