Your accounts, your assistants, your relationships, and your digital footprint are not incidental to the attack. They are the attack surface.
Day 1Personal exposureConfronting
Notes: This lesson is deliberately personal. The aim is the visceral realisation that the org chart's most senior box is also its softest, most information-rich target.
Lesson 03 · Slide 2
Why you, specifically
Authority — your "yes" moves money, people, and decisions
Access — you can reach information and systems others cannot
Trust — people act on a message that appears to come from you, without question
Visibility — your role, movements, and relationships are partly public by necessity
Notes: Authority + Access + Trust + Visibility is the leader's risk signature. Each is an asset to the adversary.
Lesson 03 · Slide 3
Business-email compromise at the decision level
Ordinary BEC steals an invoice payment. Executive impersonation steals a decision — an emergency authorisation, a supplier change, a "handle this quietly" instruction to a subordinate who will not push back.
The asymmetry
The adversary does not need your password to exploit your authority. They need your voice — your tone, your timing, your relationships.
Notes: Sets up Lesson 09's verification rules. Here, just establish that authority itself is the target.
Lesson 03 · Slide 4
The blast radius of account takeover
Once an adversary holds your email, messenger, or cloud, they do not just read — they become you:
Send instructions in your name to people who trust you
Reset passwords on other services using your inbox
Read years of context to make the next lure perfect
Watch quietly, choosing the moment of maximum leverage
Notes: Account takeover is not a privacy problem; it is an impersonation-and-pivot platform. Emphasise the inbox-as-password-reset-hub point.
Lesson 03 · Slide 5
The aggregation problem
No single fragment is secret. Together they become a targeting picture. Press → to assemble it.
Public bio+Calendar / OOO pattern+Conference badge photo+Supplier invoice leak→Targetable picture who, when, through whom
Each fragment is "harmless." The aggregate tells an adversary exactly when you travel, who books it, and which supplier to impersonate.
Notes: Reveal the pluses building up. The red node is the lesson: harmless fragments aggregate into a precise targeting picture. This is the counter-collection hook for Day 2.
Lesson 03 · Slide 6
The indirect path: people and trust chains
Adversaries rarely attack the principal first. They attack the path to the principal. Press → to trace it.
Driver / scheduler→Executive assistant→Trusted supplier→The principal
Each person in the chain is a softer target than you — and each has a legitimate reason to contact you.
Notes: The trust chain is the real attack surface. Your own hardening is necessary but not sufficient if the people around you are soft.
Lesson 03 · Slide 7
Of these four leaks about a principal, which helps the adversary most?
D. A, B, and C are static trivia. D reveals a trust chain and a timing pattern — who acts for the principal and when they are mobile — which is exactly what an indirect attack needs. Patterns and relationships beat static facts.
Notes: The instinct is "home city." The lesson is that relationship + timing data is far more weaponisable than static personal facts.
Lesson 03 · Slide 8
OSINT & relationship mapping
Open-source collection is cheap, legal, and patient. An adversary builds a map of your relationships — staff, suppliers, family, peers — and looks for the softest, best-positioned node to approach.
Professional networks reveal your org chart and your assistants
Social posts reveal travel, mood, grievances, and routines
Procurement records reveal which suppliers can credibly email you
Notes: Ukrainian officials and their personal networks were mapped and targeted this way. Make the link to the running case study.
Lesson 03 · Slide 9
So what do you do about it?
Shrink the footprint — reduce public patterns, not just facts
Harden the chain — your assistants and suppliers need the same discipline you do
Assume impersonation — build verification habits before you need them
Next
Lesson 04 — concrete, do-it-this-week rules to harden your own devices, accounts, and identity.
Notes: Three responses map to the next three lessons: footprint (L04 & Day 2 OPSEC), chain (L06 insider, L09 verification), impersonation (L04 & L09). Close on agency, not fear.