Business Email Compromise (BEC) Response
Investigate and remediate compromised email accounts before the wire transfer clears
What this engagement covers
The service
BEC is still the number-one cause of cyber-related financial loss. We contain the compromise, trace the attacker's activity, coordinate with your bank when funds are in flight, and harden the tenant.
What we test
Compromised Microsoft 365 / Google Workspace accounts, forwarding rules, OAuth grants, session tokens, delegated permissions, and downstream fraud attempts.
How we run it
Immediate account containment, evidence preservation, tenant-wide forensic review, and hardening of identity controls. We coordinate with counsel and financial institutions when wire fraud is involved.
Account containment and token revocation
Mailbox audit log analysis
OAuth grant and app consent review
Forwarding rule and delegation audit
Tenant-wide anomaly hunt
Identity control hardening
What you receive
Findings land in your tracker as you go, not only in a PDF at the end. Retest is in scope, not a change order.
- Immediate account containment
- Forensic review of mailbox activity
- Detection of attacker-created rules and grants
- Tenant-wide compromise assessment
- Financial fraud coordination support
- Identity hardening recommendations
- Written incident report
What we usually find
The issues this engagement surfaces most often. Yours will differ, but this is the shape of it.
Who this is for
Findings are mapped to SOC 2, PCI-DSS, HIPAA, GDPR, so the report drops into an audit package rather than needing to be translated first. If you need the readiness work behind one of those, that is a separate engagement.
Scope it in one call
Tell us what is in scope and we come back with a fixed price and a start date. No discovery-call maze, no hourly estimate that moves.
