Finance staff at a company protected by Cisco Security Email Threat Defense receive messages that impersonate the CFO and urge them to pay a new supplier invoice today. The messages contain no attachments and no links. Which verdict category is designed to catch this pattern?
Select an answer to reveal the explanation.
Short Explanation
No payload, no link, just a convincing boss asking for money: that's the BEC fingerprint. You can't sandbox a sentence like "pay this today", so the detection has to look at who's really sending and what they're asking for. Don't fall for the malicious verdict just because the outcome is costly.
Full Explanation
Business email compromise is a social engineering attack in which the attacker impersonates a trusted person, often an executive or supplier, and requests a payment, gift cards or sensitive data. Because the message usually carries no attachment and no link, payload-based engines find nothing to detonate. Email Threat Defense assigns a BEC verdict by evaluating signals such as display-name impersonation, sender and recipient relationship history, and the intent and urgency expressed in the text, and the policy can then remediate those messages like other threat verdicts. The malicious verdict depends on a harmful payload such as a weaponized attachment or a malicious URL, which these messages do not contain. Graymail describes solicited bulk mail such as newsletters, a nuisance rather than a fraud attempt. Spam is unsolicited bulk mail identified largely through reputation and volume, while a targeted CFO impersonation is low volume and often comes from a clean or lookalike sender. Exam caveat: BEC defense is layered, so a finance callback procedure for payment changes remains essential even with detection in place. Operational check: open a flagged message and review the listed threat techniques to confirm impersonation and urgency were the drivers.