Protecting sensitive information, maintaining its integrity and ensuring the availability of critical systems have long been central to cybersecurity. Adversaries have long exploited software weaknesses, introduced malicious code and deceived employees to undermine these objectives.
What has changed in the adversary’s playbook?
Increasingly, adversaries exploit the trust organisations place in identities, established relationships and legitimate business processes. They impersonate employees, suppliers or public authorities, obtain legitimate credentials or persuade organisations to act on fraudulent instructions. The resulting activity can look entirely normal.
Two incidents, one common weakness: Trust in Identity
Authentication seeks to establish identity; authorisation determines what an identity is permitted to do. But neither necessarily establishes whether an action is genuinely intended or appropriate. Two incidents illustrate the distinction.
In April 2025, criminals impersonated a Co-op employee[1], answered security questions and persuaded the account-recovery process to reset the employee’s account. They then used the legitimate account maliciously. Co-op’s monitoring detected suspicious behaviour swiftly, allowing its teams to respond. The impersonation succeeded; subsequent controls helped contain the consequences.
In September 2026, Revolut disclosed confidential customer information [2] in response to fraudulent requests apparently originating from an Italian government authority. The requests came through a legitimate government-associated email channel. Revolut stated that its own systems had not been breached. The criminals exploited the apparent authority of an outside institution to induce disclosure through a legitimate compliance process.
Similar vulnerabilities arise across organisations when employees act on apparently legitimate instructions from senior colleagues, suppliers, customers or public authorities.
Regulation is looking beyond data breaches and disruption
European regulation already offers useful guidance. The EU's Digital Operational Resilience Act (DORA)[3] explicitly recognises authenticity alongside confidentiality, integrity and availability. Its supporting standards also address identity management, strong authentication, access controls and monitoring. The UK Financial Conduct Authority’s operational incident reporting framework, effective March 2027[4], similarly recognises authenticity. These regulatory developments offer valuable signals. How can boards translate them into stronger safeguards against the misuse of trusted identities and relationships?
Five questions about identity and trust:
1. How strong is our identity and access management? Do we understand how our technology suppliers manage identities, authentication and privileged access, and what assurance do we have that these controls are effective?
2. Are our defences keeping pace with increasingly convincing impersonation techniques? What assurance do we have that management is evaluating relevant detection technologies, including those addressing AI-generated voice and video?
3. Are we monitoring regulatory developments and emerging threats to anticipate necessary changes in our controls, rather than waiting for new regulatory requirements to take effect?
4. Do we have clear procedures for independently verifying unusual or consequential requests, regardless of the apparent identity, seniority or authority of the sender?
5. Have we prepared employees to recognise and challenge suspicious instructions? Do our training and rehearsals build the confidence to question requests without fear of delaying legitimate business?
Think of independent verification as a form of operational multi-factor authentication (MFA): confirming consequential instructions through a separate, trusted channel, supported by employees who have the confidence and authority to challenge suspicious requests.
Staying one step ahead:
Boards need to understand where their organisation is particularly exposed to impersonation and misuse of trusted relationships and ensure that risk mitigation evolves with the threat. Effective cyber governance means anticipating risks, tailoring safeguards to the organisation and building on regulatory guidance.
[1] House of Commons, Business and Trade Sub-Committee, Oral evidence: UK economic security, HC 835, 2025: https://committees.parliament.uk/oralevidence/16269/html/
[2] Reuters, Revolut confirms sensitive customer data breach after fake government requests, 2026: https://www.reuters.com/legal/litigation/revolut-confirms-sensitive-customer-data-breach-falling-fake-government-requests-2026-09-12/
[3] European Union, Digital Operational Resilience Act (DORA), 2022: https://eur-lex.europa.eu/eli/reg/2022/2554/
[4] Financial Conduct Authority, Finalised Guidance Operational Incident Reporting FG26/3, 2026: https://www.fca.org.uk/publication/finalised-guidance/fg26-3.pdf