The most expensive attacks on executives are not technical break-ins — they are convincing requests down a trusted-looking channel. This lesson is about talking, verifying, and deciding when the channel itself may be the adversary.
Day 2CommsVerification
Notes: The Day-2 capstone: it ties devices and signals to the human act of deciding. This is where fraud actually succeeds.
Lesson 09 · Slide 2
Four properties of secure comms
Confidentiality — only the intended parties can read it
Integrity — it wasn't altered in transit
Authenticity — it really is from who it claims
Availability — you can use it when you need it
The one leaders neglect
Most tools give confidentiality. The attacks that hurt executives exploit authenticity — proving who is really on the other end.
Notes: Reveal each. Foreshadow: encryption solves confidentiality; the human problem is authenticity, which the rest of the lesson attacks.
Lesson 09 · Slide 3
End-to-end encryption — and its limits
End-to-end encryption means only the endpoints can read the message; the provider and the network cannot. It is essential — and it has two blind spots.
Limit 1: the endpoint
Encryption protects the message in transit, not a compromised phone that already holds it (Lesson 08).
Limit 2: the metadata
It hides what you said, not who you spoke to, when, and from where.
Notes: Leaders over-trust "it's encrypted." Name the two things encryption does not do. Sets up metadata slide.
Lesson 09 · Slide 4
Metadata is content
Who you called, when, how often, and from where can reveal a decision before its content ever leaks.
You + your lawyer, 11pm, three times
→
Then you + a bank
→
Then you + a rival's advisor
→
A deal is inferred — no message read
Notes: Reveal step by step. The pattern of contacts tells the story without a single decrypted word. This is why who-you-talk-to is protected too.
Lesson 09 · Slide 5
Verify people, not just channels
A secure app confirms the channel is encrypted — not who holds the other device
Verify identity out of band — confirm keys / safety numbers by a separate route
A trusted-looking channel is not the same as a trusted person
The principle
Authenticity is about the human on the far end. Confirm the person through a channel the adversary does not control.
Notes: Out-of-band verification is the bridge to the anti-BEC rule. Encryption authenticates the pipe, not the person.
Lesson 09 · Slide 6
The executive verification rule
Business-email-compromise and fraudulent-instruction attacks work by pushing a plausible, urgent request down a channel you trust. The defence is a rule, applied every time.
Urgent request arrives (email / call / message)
→
Do NOT act on the channel it arrived on
→
Call back on an independently-known number
→
Confirm with a pre-agreed code word
→
Only then act
Notes: Reveal step by step. The red node is the whole lesson: never verify a request using the channel that made it. Urgency is the attacker's tool.
Lesson 09 · Slide 7
Deepfakes make it worse
A convincing voice or video clone of someone you trust is now cheap. "It sounded exactly like them" is no longer evidence of anything.
What still works
Clones cannot pass an independent callback to a known-good number, and cannot produce a pre-agreed secret they were never told. Bind trust to something the adversary does not have.
Notes: Sets up the poll. The defence is unchanged by deepfakes because it never relied on recognising a voice.
Lesson 09 · Slide 8
A caller with your CFO's exact voice urgently requests a wire transfer. Which single step actually defeats a real-time voice-clone?
C. A fails — an adversary who researched your CFO may know "internal details," and a live clone can improvise. B fails — caller ID is spoofable, and "sounded like them" proves nothing. D fails — the email is part of the same attacker-controlled thread. Only C moves to a channel the attacker does not control and requires a secret they were never given.
Notes: Walk each distractor. The unifying error in A/B/D: they verify using something the attacker can influence or fake. Only the independent callback + shared secret breaks that.
Lesson 09 · Slide 9
Plan your channels: PACE
Decide, before a crisis, how you will reach the people who matter. Press →.
P — Primary: the normal secure channel
→
A — Alternate: a different, independent channel
→
C — Contingency: works if the first two fail
→
E — Emergency: last-resort, pre-agreed
Notes: PACE gives resilience and, crucially, an independent path for out-of-band verification. Reveal each rung.
Lesson 09 · Slide 10
Trusted decisions under pressure
Urgency is manufactured — it is the attacker's most reliable tool
A short verification delay almost never costs you a legitimate deal
Make "verify first" a norm your staff are thanked for, not punished
Leadership move
Give your people explicit permission to slow down and verify a request from you. Removing the fear of "annoying the boss" closes the fraud.
Notes: The cultural half: staff defraud themselves because they fear questioning authority. You must license the pause.
Lesson 09 · Slide 11
Two-minute drill: draft your verification rule
Write, in one sentence, the rule you will apply to any urgent request to move money or share sensitive data — including the independent channel you will use and the fact that a code word is required.
Notes: Start the timer. A concrete, pre-written rule is what people actually fall back on under pressure.
Lesson 09 · Slide 12
Day 2 recap & the road to Day 3
You hardened your signature (OPSEC), your people, your devices, and your signals
You secured the conversation — and, above all, the act of deciding
Verify the request, not the message; trust a channel the adversary can't touch
Tomorrow — Day 3
The technical foundations, AI, ransomware, deciding under uncertainty, the operating model, and a live crisis tabletop.
Notes: Close Day 2 by connecting self/org hardening to Day 3's systems, decisions, and crisis leadership. End on the verification maxim.