What is a Business Email Compromise Assessment?
A Business Email Compromise Assessment reviews the two things an email fraudster needs: a way into your email, or a convincing imitation of it, and a payment process that lets a fraudulent request through.
Business email compromise is simple and expensive. A fraudster gets into a mailbox, or imitates one convincingly, and asks someone to change a bank account or pay an invoice. No malware is needed.
Two things have to go wrong. The attacker has to get access or credibly imitate you, and your process has to let the request through. Most defences only address the first.
We look at both. We review the technical side, including sign-in protection, mailbox rules and email authentication, and the human side, meaning how payment changes are requested and checked. The fixes are usually modest in cost and make a real difference.
Who needs it?
- A business that pays suppliers or moves money by email
- A company that has had a suspicious invoice or a hijacked account
- A team where one person can approve payments alone
- A business that sends email as a trusted name its customers recognize
What problems does it address?
- A request to change bank details that arrives by email and gets actioned
- Mailboxes protected by a password alone
- Email that is easy to imitate because authentication is not set up
- Payment changes approved without an independent check
What we assess
- Multi-factor authentication on every mailbox
- Mailbox rules and external forwarding
- Administrator and other privileged accounts
- Email authentication records such as SPF, DKIM and DMARC
- How easily your domain and your executives can be impersonated
- Email filtering and phishing protection
- Payment and banking-change processes, and where a fake request could slip through
What you receive
- A review of your email configuration and exposure
- Findings ranked by how likely they are to be used
- Specific settings to change
- Recommended checks for payment and banking-detail changes
- A short briefing for the staff who handle payments
What happens afterward?
You decide what to do with the findings, and with whom. Your team or IT provider can carry them out, with Avertix guiding the changes and retesting them if you want, or you can keep senior help on hand through an advisory arrangement. Many clients stop after the report.
How the engagement works
Free consultation
A 45-minute call with a senior consultant about your situation. It is a conversation, not an assessment. You leave with a recommended next step.
Scope and price
Scope, deliverables and price are agreed in writing before any work starts.
Assessment
The consultant who scoped the work does it. Requests to your team stay small, and we work with your IT provider where you have one.
Findings and walkthrough
You get a written report and a walkthrough. Findings are ranked, so you know what to do first and what can wait.
