Big Projects Make Big Targets

Most people picture a breach as something loud. Locked screens, a ransom note, systems down. That version still happens, but it is no longer where most of the money goes.

The FBI’s 2025 Internet Crime Report logged $20.9 billion in reported losses across more than one million complaints, a 26 percent increase in a single year. Business email compromise accounted for roughly $3 billion of that from just 24,768 complaints. That is 2.5 percent of all complaints filed, producing about 15 percent of all reported losses, with an average loss of $123,005 per incident.

Put plainly, business email compromise is the largest single source of reported losses among attacks aimed at organizations. And 86 percent of that money moved by wire transfer or ACH, meaning these attacks are not landing in spam folders. They are landing inside real financial workflows and clearing.

Everyone is on the same playing field

This is the part that catches people off guard. A city government, a mid-sized manufacturer, a six-person contracting firm, and a startup still working out of a shared office all face the exact same attack. The email looks the same. The method is identical. The only thing that changes is the dollar amount on the wire.

Attackers are not sorting targets by size. They are sorting by opportunity. A large organization has bigger payments, but a small one often has fewer approval steps, no monitoring, and nobody positioned to question an invoice at 4:45 on a Friday. Being small is not cover. In many cases it is the advantage the attacker is counting on.

How it actually works

The simplest version starts with credentials. An attacker gets a valid username and password through a convincing phishing page, then logs in and changes nothing. They sit in the mailbox, read months of correspondence, learn your vendors, your tone, your approval chain, and your payment cycles. When a routine invoice is due, one arrives with updated banking details at exactly the right moment.

Multifactor authentication helps, but it is not the wall people assume it is. Session cookie theft has become one of the most effective ways around it. Once you sign in, your browser holds a token proving you already authenticated. Modern phishing kits sit between you and the real login page and capture that token as it is issued. Infostealer malware pulls the same tokens straight off an infected machine. The attacker then walks into your account as a fully authenticated session, no password prompt and no MFA challenge, because as far as the system is concerned you already passed both.

The quieter version never touches email at the start. An attacker gets a foothold somewhere nobody is watching and waits. A single unpatched workstation in an office nobody uses. A personal phone with company mail on it. A network printer, a security camera, a smart thermostat, a point of sale terminal, a shop floor sensor, or a router a vendor installed years ago and never updated. These devices rarely support endpoint protection, rarely get patched, and almost never get reviewed. They are permanent, quiet, and connected to everything.

From that foothold, patience does the work. The attacker maps the network, learns which machines matter, harvests credentials and session tokens as people sign in, and moves sideways until they reach an account with signing authority. Mandiant’s latest incident response data puts the median time an intrusion sits undetected at 14 days, and that is the midpoint, not the ceiling. Nothing technically breaks, so nothing alerts. By the time a fraudulent payment request goes out, it comes from inside a real account, references a real project, and lands in the middle of a real conversation.

AI has sharpened all of it. Spoofed domains, cloned writing styles, and voice impersonation now put a fraudulent request within a hair of the genuine article. Victims reported more than $30 million in email fraud losses involving AI in 2025, and since that figure depends on victims recognizing AI was used, treat it as a floor rather than a measurement.

Why the old model fails

Most organizations that get hit are not careless. They have antivirus. They have a firewall. They have someone reliable who keeps the network running. What they usually do not have is anyone whose actual job is to assume an attack is already underway.

The break/fix model made sense when threats arrived on disks and the worst outcome was a dead hard drive. One capable generalist could cover it. That person is still valuable, but asking them to simultaneously run identity governance, email authentication, device inventory, around the clock monitoring, payment controls, and incident response is asking one person to be an entire security department. Reactive support cannot catch an attack that never triggers a support ticket.

What actually stops it

Verification that happens outside of email. Any change to banking details, and any transfer above a set threshold, gets confirmed by phone to a number you already had on file, never a number supplied in the request. It costs nothing to implement at any size, and it is the control that breaks the attack at the exact moment it pays off.

Behind it sits the rest of the stack. Phishing-resistant multifactor authentication that cannot be relayed, along with conditional access and short session lifetimes so a stolen token stops working quickly. Email authentication configured properly so your domain cannot be convincingly spoofed. A real inventory of every device on the network, with the unmanaged ones segmented away from anything that matters. Continuous monitoring that flags unusual mailbox rules, impossible sign-in locations, and new devices appearing where they should not. A written response plan that gets executed in minutes, not days. The FBI’s recovery team froze $679 million for victims in 2025 with a 58 percent success rate, and that outcome depends almost entirely on how fast the fraud is caught. Wire recalls work inside a short window and then stop working at all.

The local picture

Gulf Coast organizations are not too small or too far off the map to be worth targeting. Attackers are opportunistic and they follow money that moves on a schedule. Construction and contracting, port and logistics operations, healthcare practices, real estate closings, and professional services all generate the kind of routine payments that make this work.

Cyclone 365 helps Gulf Coast organizations of every size close those gaps, from Microsoft 365 hardening and identity protection to device and network visibility, continuous monitoring, phishing defense, payment verification policy, and response plans built to move in minutes. The goal is not to replace the person keeping your systems running. It is to put real security infrastructure behind them so one convincing email cannot undo years of work.