How to evaluate business email compromise software

No product category stops payment fraud that arrives by email. Any evaluation of business email compromise software that assumes one exists ends in a subscription and unchanged risk.

It sets out what to require of the tools that genuinely help at the edges, what none of them can do, and how to test a candidate against the case you should actually be afraid of.

The expensive version of this fraud has no attachment, no link and no malicious code. It often comes from a real account at a real company you really do business with, leaving a scanner nothing to find.

The tooling reduces volume and improves visibility. The control that prevents the loss is a rule about how money moves, and it costs nothing.

What to take away

What tooling can and cannot reach

Read the last two rows before you sign anything. They define the ceiling.

What to require

Sender and domain handling. Help publishing and monitoring authentication records for your own domain — SPF and DKIM to prove who really sent a message, and a DMARC policy that says what to do when they fail — reporting you can actually read, protection for your named internal senders against display-name imitation, and a way to see and act on close variants of your domain and your main suppliers' domains. If you need to understand the records themselves before judging a product's help with them, the National Cyber Security Centre's email security and anti-spoofing guidance explains them without selling anything.

Visible marking. External sender labeling that survives forwarding and replies, and a warning on first-contact senders. Marking is worth more than blocking here, because the goal is to interrupt an assumption rather than to stop a message.

Mailbox integrity signals. Alerting when a rule, a forwarding address, a delegate or a connected application is added to a mailbox. This is the single most useful detective feature in the category, and it should reach a named person, not a shared address nobody opens.

Sign-in visibility. Unusual location and unusual client reporting for the accounts that matter, meaning finance, senior management and administrators. Ask what the retention period is on that log, since it decides whether you can answer questions later.

Retroactive removal. The ability to pull a message out of mailboxes it has already been delivered to, and a stated time for how long that takes. Anything that gets through the filter is discovered after delivery by definition.

Reporting and release. A one-click report button in the mail client, and a fast, self-service way to release a false positive. Both matter more than detection rate. A filter that holds a customer's purchase order for a day costs real money.

Export and retention. Your logs and quarantine history in a format you can read elsewhere, retained long enough to be useful after a delayed discovery.

Notice what is absent from that list: any claim to judge whether a payment instruction is genuine. That judgment is a process control, described in business email compromise.

Test it against the case you fear

Vendors demonstrate against the cases they win. Run the following instead, during the trial, and write down what happens.

The compromised supplier. Ask directly: a genuine message from a genuine, authenticated supplier account requests a change of bank details. What does your product do? The honest answer is very little, and a vendor who says otherwise has told you something useful about the rest of their claims.

The false positive. Send yourself something that looks like your own normal commercial traffic: an invoice with an unusual attachment type, a message from a new customer domain. If it is held, time how long a release takes through the channel your plan includes, not through the salesperson.

The delivered message. Have a message reach five mailboxes, then remove it. Time it end to end. This is the number you will care about.

The mailbox change. Add a forwarding rule to a test mailbox and see whether anyone is told, how quickly, and through what channel. Then check the alert is legible to the person who would receive it at seven in the morning.

The question three months later. Ask the product who signed in to a named mailbox on a given day, and which rules existed then. If it cannot answer, its retention is the feature you are actually buying and you should price the longer tier.

The general trial discipline in best security foundations software 2027 applies here too, particularly giving the tool to the least technical person on the team before you commit.

Where the money is better spent

For most small businesses the ranking is unsentimental.

Strong authentication on finance and administrator accounts prevents the mailbox takeover that makes the convincing version possible, and it is usually included in what you already pay for. The United States Cybersecurity and Infrastructure Security Agency's multi-factor authentication guidance sets out which methods are worth the enrollment effort, and the short answer is the phishing-resistant ones — passkeys and security keys — rather than one-time codes sent by text message.

A written verification rule for payment changes prevents the loss even when everything else fails. Alerting on mailbox rules is cheap and catches the case where the first two were not enough. A dedicated product comes after those, and it buys you visibility and volume reduction rather than immunity.

If the budget is small, that order is the whole recommendation. If the budget is larger, the order does not change, it just moves faster.

Common questions

Will a product stop us losing money?

Not on its own, and treating a purchase as the answer is the failure this whole category invites. Products reduce how many bad messages arrive and improve how quickly you notice a compromised mailbox. A payment leaves because a person approved it, and the control on that is a rule about verification, applied without exception.

How should we compare two candidates?

On the tests above, scored against one written scenario, with the operator's time priced in. The approach comparison in security foundations comparison is the frame; the specific scenario should be your own worst realistic day, written down before either demonstration.

Does adding a second filtering layer help?

Sometimes, and it adds administration, two places to check when mail goes missing, and two sets of false positives. Before buying a second layer, find out what the first one is configured to do, because the common finding is that it was left on defaults. That is a configuration project, not a purchase.

What about training instead?

Both, in the right order. Training installs the habit of verifying and reporting; it does not make people reliable detectors of a well-made request, and any offer sold on that promise is overselling. The realistic scope of it is covered in security compliance training.

We are small enough that the owner approves every payment. Is that enough?

It removes one failure mode and creates another, since the request that names the owner as its source is the common shape.

One approver still needs the verification step, performed by them, on a number held in advance. That means calling the supplier back on a number you already had — never the one in the message that asked for the change — and having a second person approve any change of payee details.

Who can approve and who can change payee details should also be visible in your access lists for identity and access.