Business email compromise (BEC) attacks involve hackers creating emails that impersonate a senior executive or a business partner to steal money through deception. Scams using BEC have become sophisticated and difficult to stop because cybercriminals focus on delivering payload-less attacks that can bypass traditional security methods.
Criminals target both small businesses and large corporations, and attacks are costly, according to figures from the Federal Bureau of Investigation (FBI). In 2023, businesses reported 21,489 complaints totaling $2.9 billion in losses.[1]
Unfortunately, traditional security measures can no longer keep up when it comes to detecting and preventing BEC as attacks often rely on signatures or heuristics, which require constant updates to keep pace as criminals update their methods. If an attacker makes a minor change to their tactics, the signature-based detection can become ineffective. That’s why a modern BEC defense strategy must both incorporate artificial intelligence (AI) to identify and mitigate threats, as well as leverage existing security measures.
AI-powered threat detection provides security layers and combines multiple signals to detect BEC attacks more effectively.AI uses advanced technologies like natural language processing (NLP) and machine learning to analyze the output of proven defenses. This approach maximizes detection effectiveness and minimizes false positives by providing the necessary context.
AI considers relationship and reputational features from a social graph to identify anomalous patterns. Suspicious messages are passed through an NLP text extraction model to identify phrases associated with BEC attacks. The model then provides a score to determine whether the message should be blocked.
Enhancing BEC detection
AI’s ability to detect anomalies and predict potential BEC attacks with high accuracy hinges on several advanced features. These include:
- Natural language understanding (NLU): Proprietary NLU models based on large language models understand phrases present in BEC attacks, such as urgency, bank transfer requests, and switches in communication channels. This deep understanding enables AI to classify whether a message is a potential BEC attack.
- Automatic classification: AI models automatically classify messages by analyzing underlying patterns not immediately obvious to humans. This capability allows for the identification of BEC threats even when traditional indicators are absent.
- Social graphing technology: AI uses social graphing technology to detect abnormal communication patterns, providing additional context and accuracy in identifying BEC threats.
- Multilayered detection engines: AI integrates several detection engines, including email DNS authentication failures, domain and user similarity checks, IP address reputation, and feeds of known indicators of compromise. This multilayered approach ensures threats are detected early in the process.
Cloud-based email security platforms
Integrating AI with cloud-based email security platforms significantly enhances an organization’s overall defense against sophisticated email threats. Ideally, security leaders should seek a platform with multiple detection engines that work together to filter out malicious emails before they reach the user.
By combining these layers, AI-powered platforms can reject malicious messages early and ensure that only a subset of emails undergo complex NLP text extraction and threat model inspection. This reduces detection times and enhances overall security efficiency.
Add AI to your defense arsenal
AI is not just a tool but a critical component in safeguarding business communications against BEC attacks. By integrating AI with cloud-based email security platforms, organizations can build a robust defense that evolves with the threat landscape and provides protection against sophisticated email-based attacks. Mimecast provides detection across both the attack preparation and execution phases of a BEC attack. This includes the identification and takedown of resources created to deliver phishing/BEC emails, protection against phishing links and attachments, and prevention of victim response through outbound and internal email scanning. Learn more about how Mimecast can help you defend against BEC.
[1] Federal Bureau of Investigation, 2023 Internet Crime Report, https://www.ic3.gov/Media/PDF/AnnualReport/2023_IC3Report.pdf