Business email compromise

The pattern is consistent. Access is obtained or a lookalike domain registered, correspondence is read quietly for weeks, and at the moment a genuine invoice is due, a message arrives from the expected person with the expected history and new bank details. Nothing about it looks like an attack, because almost all of it is authentic.

Technical controls reduce the odds; a process defeats it. Any change of payment details is verified by a call to a number already on file — never a number from the message — and the rule holds regardless of who appears to be asking or how urgently.

Trusting the thread rather than the channel

The reply arrives inside a real conversation, quoting real history, from an address off by one character. Familiarity is precisely what the attack manufactures. Verify out of band, every time, with no exception for seniority or urgency.

SPF, DKIM and DMARC

Three DNS records that together decide whether anyone can send mail pretending to be your domain — and whether your own mail reaches the inbox.

---

Two-factor and multi-factor authentication

Requiring a second proof of identity beyond the password — and the factors differ enough in strength that “we have 2FA” says almost nothing on its own.

---

Account recovery path

The chain of accounts that can reset each other's passwords — and therefore the real security level of every account in it, which is the level of the weakest.

All forty-five termsWhat this is regulated by in the UAE

Is this one right in your own numbers?

The definitions are the easy part. Whether the figure on your dashboard was computed this way is a different question, and usually the more expensive one.