Spear phishing executives is a process problem
Assistants, travel, and public speaking calendars are OSINT. Treat VIP mailboxes like privileged accounts.
ITSIGN Administrator · May 14, 2025 · 2 min read
If the CEO's calendar is public and the assistant can move money, you have a design problem.
VIP mailboxes get phishing-resistant MFA, tighter forwarding controls, and a written stand-in process when someone is travelling.
Train the assistant as carefully as the principal. That is security awareness plus cloud and Microsoft 365.
Related reading
Email retention, PIPEDA, and the mailbox you never deleted
Keeping everything forever is not a strategy. It is a larger breach waiting for a number.
2 min read
When the phish comes from a vendor you trust
Their tenant, your payment. Callback still wins. So does knowing who is allowed to change details.
2 min read
Turn off IMAP and POP before someone else uses them
Legacy protocols skip modern MFA. They are still on in tenants that were migrated in a hurry.
2 min read
Want this applied to your environment?
A short conversation, an honest assessment of your current setup, and a clear proposal. No obligation and no pressure.