detecting-business-email-compromise-with-ai

BEC detection relies on behavioral baselines, writing-style analysis, and identity checks rather than payload scanning. Deploy an API-based AI email platform, train it on at least 30 days of historical mail, and flag deviations in sender behavior, tone, and request type.

Common options include Abnormal Security, Microsoft Defender for Office 365 with its Impostor Classifier, Tessian, Ironscales, and Darktrace Email. These platforms use NLP and behavioral analytics rather than signature or keyword rules.

Attackers register lookalike or cousin domains that pass authentication for their own domain, and compromised legitimate accounts authenticate normally. Authentication validates the sending domain, not the brand or person being impersonated, so homoglyph and display-name checks are needed.

Train models on at least 30 days of email, tune thresholds per role with stricter settings for finance and AP staff, and account for new hires or M&A introductions. Target a false positive rate below 0.05% after baseline training.

Replay a no-payload test email impersonating an executive using a lookalike domain, urgency language, and a payment-change request, then confirm the model flags it. Also verify Reply-To mismatch and vendor bank-change scenarios are caught.