The two native signals
- External sender tagging (ExternalInOutlook — org-level, " "on by default now): Outlook stamps '[External]' / the external chip on mail from outside the org. Cheap, universal (works where fancy banners don't), and the anchor for user training: 'external + urgent-money-request = stop'. Allow-list exceptions exist for trusted partners (use sparingly — every exception is a spoofing target).
- First contact safety tip (anti-phish policy): 'you don't often get mail from this sender' — the mailbox-intelligence signal (anti-phish concept) surfaced to the user at the moment of a novel sender, which is exactly when BEC's lookalike lands.
What they catch and what they don't
Catch: the low-effort spoof a distracted user would've trusted, the first-contact lookalike, the 'CEO' from a gmail address. DON'T catch: a COMPROMISED internal account (it's genuinely internal — no external tag; the BEC concept's whole point), a perfectly-authenticated malicious partner, or a user who's banner-blind after seeing '[External]' on 200 legitimate mails a day (the fatigue problem — which is why tagging is a FLOOR, paired with impersonation protection for the targeted attacks).
Making them matter (the human layer)
Tagging without training is decoration. The pairing: teach the tag's MEANING (external = came from outside, verify money/access requests via a second channel), keep the allow-list tiny (so the tag stays trustworthy), and pair with impersonation protection so the DANGEROUS external mail (lookalike execs) gets more than a tag — it gets quarantined. The layered posture: tag everything external (awareness), quarantine the impersonations (protection), train the verify-by-phone reflex (the actual defence against invoice fraud).
What to watch (proofs)
- The signals' state: ExternalInOutlook enabled + allow-list size (small!); first-contact tip on in the anti-phish policies (scanned) — both defaults that 'hardening' scripts sometimes disable.
- Fatigue reality: the ratio of external mail to internal per user population — heavy-external roles (procurement, recruiting) need MORE than the tag, by design.
- The training proof: phishing-sim results on external-lookalike scenarios — the tag+training working shows as a low click rate on exactly this scenario class.
- Allow-list drift: exceptions added over time (audit) — each one re-examined; a bypassed external tag on a spoofable partner is a gift to attackers.