BEC Keeps Winning Because It Looks Exactly Like Normal Work

The dirty secret of business email compromise is that nothing detonates. There's no attachment to sandbox, no macro to flag, no second-stage payload phoning home to a domain registered eight hours ago. It's a person, writing an email, asking another person to do something the business does every day.

That's why BEC keeps clearing the bar.

In practice, the failure mode here is that secure email gateways were architected for a threat model where badness is in the artifact. Strip the artifact, write fluent English, register a lookalike domain or — better — compromise a real mailbox upstream at a supplier, and the message sails through. The signal isn't in the headers. It's in the behavior.

That's the pitch behind the wave of "behavioral AI" email products: instead of asking "is this attachment malicious," they ask whether this sender, on this thread, at this time, asking for this thing, fits the historical pattern. Does the CFO normally email the AP clerk about wire changes at 9:47pm from a mobile client? Does this vendor usually send invoices from a Gmail address? Has this internal account suddenly developed an interest in mailbox rules that auto-delete replies from the real recipient?

The approach is sound. It's also not magic. A few things worth saying out loud before you sit through another vendor webinar on this:

• Behavioral models need a clean baseline. If your tenant is already compromised when you turn detection on, the "normal" the model learns includes the attacker.
• Auto-remediation is where these tools earn their keep, but only if you trust the verdict enough to claw back messages from inboxes without a human in the loop. Most SOCs don't, at first.
• The detections that actually matter for BEC are often in Microsoft 365 or Google Workspace audit logs — inbox rule creation, OAuth app consent, impossible travel — not the message body. Make sure whatever you buy reads those signals, not just SMTP.
• The "AI" part is doing less than the marketing suggests. Most of the lift is graph analysis of communication patterns plus NLP for tone and intent. That's fine. Call it what it is.

One thing the post-mortem will say, every time: the wire went out because a human believed another human. The control that would have stopped it was an out-of-band callback to a known phone number, not an inbox banner that says "external sender." Banners are wallpaper now.

If you're evaluating tools in this space, push the vendor on false-positive rates against your finance team's actual mail flow, and ask exactly which Microsoft Graph or Workspace APIs they're consuming. The rest is theater.

Operational takeaway: treat BEC as an identity and process problem with an email-shaped symptom, and budget accordingly.