Business email compromise in 11 minutes
The inbox rule is the tell. How we catch it, and the four settings that stop most of these cases before they start.
Sam Whitaker, detection engineering lead
7 min
Almost every business email compromise we see follows the same order: a phished password, an approved MFA push, and within two minutes a new inbox rule that hides replies from the real owner.
Why the rule matters
Attackers need time inside the conversation to change bank details convincingly. The rule buys them that time. It is also the clearest signal they leave.
Four settings worth an afternoon
Number matching for MFA push notifications.
Blocking automatic forwarding to outside addresses.
Alerts on new inbox rules for finance and executive mailboxes.
A callback rule for any change to vendor bank details.
Thirty minutes to find out who is watching your network tonight.
Bring your last insurance questionnaire or audit finding. We tell you in plain words where you are exposed after hours and what closing it would cost, then send a written quote within two business days.