Arsen makes it possible to use a company’s legitimate domain as the sender in custom phishing simulations, rather than relying on a lookalike domain for impersonation. This approach recreates a key factor behind successful business email compromise attacks: employees receive a request from an email address that provides no technical grounds for suspicion.
What is business email compromise?
Business email compromise (BEC) is a form of social engineering in which attackers impersonate or compromise a trusted business identity. The identity typically belongs to a company executive, a finance team member, or a supplier. The objective is to persuade an employee to authorize a payment, disclose sensitive information, or bypass an established procedure.
BEC messages generally contain no malicious software, attachments, or hyperlinks. Instead, the attack depends on the recipient’s decision.
These emails can pass authentication checks and appear consistent with legitimate business processes. As a result, technical email security controls may have limited ability to identify the threat. The effectiveness of protection therefore depends largely on whether employees verify suspicious or sensitive requests.
How it works
During the creation of a custom phishing scenario, Organization domain can be chosen as the sender option instead of Spoofing domain.
Arsen sends the simulated message through an existing Microsoft or Google integration, using API-based delivery exclusively. This ensures that the email is sent from a domain owned and used by the organization. No mail gateway relay or external sending infrastructure is involved.All standard capabilities of the Arsen phishing scenario builder remain accessible. These include configuring the sender identity, email subject, message content, landing page, attachments, and reporting.
The resulting simulation operates as a one-way phishing scenario.
Comparing organization domains and spoofing domains
| Spoofing domain | Organization domain | |
| Sender address | A lookalike domain registered by Arsen | A verified domain belonging to the organization |
| Delivery method | Conventional email delivery | Delivery exclusively through Microsoft or Google APIs |
| Simulated threat | External identity impersonation and recognition of deceptive domains | Business email compromise and trust in internal identities |
| Behavior evaluated | Whether employees recognize suspicious sender domains and other warning signs | Whether employees independently verify the legitimacy of a request |
| Conversational simulations | Available | Unavailable |
| Configuration requirements | No additional setup | Microsoft or Google email-delivery integration |
- Campaigns using spoofing domains assess employees’ ability to recognize technical indicators of impersonation.
- Simulations sent from an organization’s legitimate domain eliminate that indicator altogether. Instead, they evaluate whether employees perform verification through a separate communication channel before acting on financially or operationally sensitive instructions. This behavior is a meaningful indicator of an organization’s exposure to real-world BEC attacks.
Requirements
- An active Microsoft or Google integration for email delivery.
- A verified domain that the organization owns and actively uses.
- A custom phishing scenario. BEC simulations do not support conversational scenarios.
What types of BEC attacks can be simulated?
Since the simulation uses a domain owned by the organization, each of the following scenarios involves impersonating an internal employee or business identity rather than an external contact.
| Scenario | Identity being impersonated | Primary targets | Requested action |
| Executive impersonation | CEO, CFO, or managing director | Finance personnel and executive assistants | Initiating an urgent money transfer, approving an exception to standard procedures, or completing a confidential assignment |
| Invoice and payment modification | A colleague from finance or accounts payable | Accounts payable specialists and financial controllers | Authorizing a new invoice or approving changes to beneficiary payment information |
| Payroll redirection | HR representative or payroll administrator | HR and payroll personnel | Updating direct-deposit information or modifying bank account details |
| IT and helpdesk impersonation | Internal IT department or service desk | Employees across the organization | Re-entering account credentials, registering MFA again, or validating a device |
| Legal and M&A confidentiality | General counsel or executive responsible for a transaction | Finance, legal, and transaction teams | Accessing a confidential document while maintaining discretion |
| HR communications | People operations team | All employees | Confirming personal information or acknowledging an internal policy document |
These exercises should primarily target employees with the authority to carry out the requested actions. Relevant groups include finance, payroll, procurement, executive support, and personnel authorized to modify payment records.
Conducting BEC simulations across the entire company can make the results less informative. Targeted campaigns provide a clearer assessment of the verification practices and potential risks associated with employees who control financially or operationally sensitive processes.
