Identity, at AI Speed: What 279 BEC Cases Reveal About GenAI Attacks

In 79% of the business email compromise cases we investigated last year, multi-factor authentication was in place and working.

The user received the prompt and approved it. Authentication succeeded. And the threat actor walked in anyway, because they were sitting in the middle of that exchange, and what they wanted was not the password.

This single finding explains most of what changed. Across 343 incidents investigated between January and December 2025, that is, 2,064 hours of incident response work across mid-market organisations in the Benelux and Germany, business email compromise accounted for 81% of everything we handled. That is, people logging in with credentials that belonged to someone else, inside environments that had no reason to distrust them.

Here is what Eye Security's data says about how this happens, and why the thing that decides the damage is the clock.

What is business email compromise (BEC), and why is it now the dominant threat?

Business email compromise (BEC) is an attack in which a threat actor gains access to a legitimate email account, or convincingly impersonates one, and uses that trusted position to redirect payments, harvest information or reach further into an organisation and its suppliers.

There is no malware in the classic sense. There is nothing for a signature-based tool to catch. The threat actor is not breaking a control; they are using one. This is why BEC is so consistent across markets: 83% of all incidents in the Netherlands, 87% in Belgium, 68% in Germany.

The 2025 shift from breaking in to logging in

For roughly two decades, defending an organisation meant defending infrastructure. You hardened the perimeter, patched what faced the internet, and watched for things that did not belong.

This model assumed threat actors would have to break something to get in. 

Then work moved into SaaS. Every new application created identities, often outside centralised management. Machine identities, API integrations and AI-driven workflows added more, access paths that are frequently over-permissioned and rarely monitored with the same rigour as a human account. Identity became the connective tissue of the business, and therefore the most reliable route through it.

The consequence is a class of intrusion that produces almost no signal. We can have a valid credential, a legitimate session token, a mailbox rule created by an account that has every right to create mailbox rules. And then comes an invoice sent from a real supplier address, in the middle of a real conversation, referencing a real purchase order.

This is not only a cloud phenomenon. On-premises intrusions have gone the same way, progressing through credential access, privilege escalation and lateral movement rather than technical exploitation. Identity is no longer just how someone gets in. It is the pathway the entire attack travels along.

How threat actors bypass MFA: adversary-in-the-middle explained

MFA bypass in 79% of cases sounds like a failure of MFA. Still, it is more accurate to say threat actors stopped attacking it and started routing around it.

The dominant technique is adversary-in-the-middle phishing. The victim clicks a link and reaches what looks exactly like the Microsoft 365 sign-in page because functionally it is. The threat actor's infrastructure sits between the user and the real service, relaying the exchange in real time. The user enters credentials, which are captured. Microsoft issues an MFA challenge, which passes through. The user approves it on their phone, legitimately. Authentication succeeds.

What the threat actor captures is the session token, the credential the browser holds afterwards so you are not asked to log in every time you open your inbox. With that token, the threat actor has an authenticated session. No password needed. No second factor needed. Nothing to prompt the user again.

From the platform's perspective, nothing is wrong. Someone authenticated correctly and is now reading their email.

Two related techniques appear in the same dataset: token theft, and session hijacking more broadly. All of them share the same logic: attack the state that exists after authentication, not authentication itself.

Still, MFA matters and you should keep it. But it is no longer a control you can treat as decisive on its own.

Business email compromise: where the entry point still is

63% of investigated BEC incidents originated from a phishing link. Add attachment-based and service-based phishing and the overwhelming majority of intrusions began with social engineering alone. Direct credential misuse was marginal by comparison: cloud account compromise at around 6%, domain accounts and generic phishing each under 1%.

21% of incidents in the dataset were classified as unknown root cause. In email compromise scenarios, the forensic trail is thin, and in some cases the root cause could not be reconstructed or was not investigated. 

Where GenAI changed the picture

The interesting thing about 2025 was that identity attacks became accessible.

Phishing-as-a-service (PhaaS) frameworks now package adversary-in-the-middle capability into something operable without deep technical skill. The barrier to entry has collapsed. A wider population of threat actors has gained the ability to work inside trusted identity flows.

Generative AI did not invent a new attack technique but it did compress the time between intent and execution, and raise the baseline quality of the pretext. Writing that used to give phishing away is now fluent in any language. Context that used to take manual research is now assembled quickly. Attempts can be iterated cheaply.

This is the defining dynamic of the current landscape: a lower skill floor combined with higher output quality, aimed at an attack surface built entirely from trust. The convincing email is no longer the hard part.

The number that decides the outcome

Everything above is context. Here comes our key finding:

Median dwell time for BEC in monitored environments: 19 minutes. In environments without continuous monitoring: 18 days.

The reporting timeline follows the same shape. Time from incident report start to delivery averaged 106.86 minutes with MDR in place, against 12,199 minutes without. Incident handling effort averaged 2 hours per case with monitoring, against 16 hours without.

Why? In an unmonitored environment, BEC is typically discovered by a human noticing something wrong. This is usually a payment request that does not add up, often after the payment has gone out. 

Eighteen days is enough time for a threat actor to read the mailbox thoroughly, learn how your organisation phrases things, identify which relationships involve money, set up forwarding rules so their activity stays invisible to the account owner, wait for a genuine invoice thread, and insert themselves into it at exactly the right moment with exactly the right tone.

Looking across a longer window, the pattern holds. Over 2023–2025, median dwell time in non-MDR environments was 24 days and 12 hours, against 23.8 minutes in monitored ones.

A word about the 92%

92% of the BEC incidents in this dataset, that is, 257 of 279, occurred in MDR-managed environments.

Monitored environments detect BEC because someone is looking. Continuous telemetry, active threat hunting and 24/7 analysis surface activity that generates no user-visible symptom. Unmonitored environments produce fewer detected incidents, which does not, however, translate into fewer incidents.

This means that threat actors are not less active where nobody is watching. Rather, they simply are less likely to be seen, for longer periods of time.

Why manufacturing and construction lead the table

In the Eye Security dataset, manufacturing and industry accounted for the largest share of BEC incidents at 25%, followed by real estate and construction at 17%, financial services at 9%, and transport and logistics at 8%.

What connects the leaders is invoice volume, supplier complexity, and how routinely payment details legitimately change. BEC needs an environment where a message about a new bank account is a normal thing to receive. A manufacturer with 400 suppliers and constant purchase-order traffic offers far more places to insert a fraudulent request than a company with six vendors and a fixed monthly cycle.

Financial services remain targeted despite strong controls. Healthcare and public sector show a different profile, where operational urgency and fragmented systems slow detection.

Lower counts in technology and public services almost certainly reflect visibility and reporting differences rather than reduced threat actor interest.

BEC: the regional breakdown

Germany is the instructive regional case. BEC accounted for 68% of German incidents, the lowest of the three markets, and MFA bypass occurred in 62.5% of cases, also the lowest. The explanation is architectural: German organisations have retained more on-premises infrastructure and adopted cloud more gradually, producing a smaller identity-driven attack surface and a correspondingly higher share of infrastructure-based attacks such as ransomware. Cloud adoption and identity risk move together.

"BEC thrives not on technical complexity but on credibility and timing. The data reinforces that defending against such incidents calls for email authentication controls, continuous user awareness, and vigilant financial process validation to counter manipulation at its human core."

— Lodi Hensen, VP Security Alliances, Eye Security

The turn to identity, assisted by GenAI: what security leaders must do

The findings point to a specific set of priorities:

1. Assume session tokens will be stolen. MFA bypass in 79% of cases means token theft is the expected path. Shorten session lifetimes, enforce sign-in risk policies, and treat impossible-travel and anomalous-token signals as investigable events.

2. Move to phishing-resistant authentication where you can. Passkeys and FIDO2 hardware keys are materially harder to relay through an AiTM proxy than push notifications or codes.

3. Monitor the post-authentication layer. The attack becomes visible after login: new mailbox rules, unusual forwarding, atypical mail access patterns, OAuth grants nobody requested.

4. Put a control on payment changes. Any change to supplier bank details should require verification through a channel other than email.

5. Get visibility across the whole identity estate. Including SaaS applications with their own user directories, API integrations, and machine identities.

6. Follow up on alerts with discipline. BEC accounted for the overwhelming majority of recurring incidents within a single year.

Identity, at AI speed: the new frontier

BEC is the most visible expression of a structural shift. The threat actors in this dataset used no novel exploits and no advanced malware. They used legitimate access, familiar workflows and increasingly capable social engineering, producing intrusions that are difficult to distinguish from normal business activity.

Two findings carry the most weight. Over 99% of these incidents occurred in Microsoft 365 environments, and MFA was bypassed in 79% of them. Taken together, they locate the challenge in the identity layer rather than in infrastructure or endpoints, and they indicate that a correctly configured preventive control was present in most cases and did not determine the outcome.

What did correlate with outcome was detection time. The 19-minute versus 18-day gap in median dwell time, alongside the difference in handling effort (2 hours per case against 16) is the clearest signal in the dataset. Neither figure describes a difference in tooling. Both describe whether continuous monitoring was in place.

The German data offers a useful control. Lower cloud adoption produced a smaller identity attack surface, a lower BEC share at 68%, and a lower MFA bypass rate at 62.5%, with a correspondingly higher share of infrastructure-based incidents. Identity risk tracks identity surface. As more of the mid-market completes the move to cloud and SaaS, the Benelux figures are the more likely trajectory.

Against this backdrop, the conclusion is narrow. Identity is better treated as a continuously monitored system than as a set of controls configured once, and the measure of a defence against BEC is how quickly it surfaces activity that looks entirely legitimate.