Business Email Compromise (BEC) is the most financially damaging form of cybercrime, costing organizations billions annually. The attack pattern is simple and devastating: an attacker impersonates an executive — typically the CEO or CFO — and sends an urgent payment instruction to the finance team. The email looks legitimate, the tone is authoritative, and the pressure is high. Without structured verification, finance teams often comply.
GuardianOS addresses BEC through a multi-layered verification system that introduces friction only for high-risk requests while keeping legitimate executive payments flowing smoothly.
Layer 1: Request Authentication. Every payment request entering the system — whether from email, messaging platform, or direct system entry — is authenticated at the source. The authentication agent verifies the sender's identity using multiple signals: email headers and SPF/DKIM/DMARC validation, sender behaviour patterns (does this executive typically send payment requests at 11 PM on a Saturday?), device and location fingerprinting, and message-content analysis (does the language match this executive's typical communication style?). Requests that fail authentication are blocked immediately and flagged for security review.
Layer 2: Dual-Channel Verification. For any payment request above a configurable threshold (typically $10,000), the system requires verification through a second, independent channel. If the request arrived via email, the executive must confirm it through the GuardianOS mobile app with biometric authentication. If the request arrived through a messaging platform, confirmation must come through email or phone. Attackers who compromise one channel rarely control two — dual-channel verification breaks the BEC attack chain.
Layer 3: Anomaly Detection. Even authenticated, dual-channel-verified requests are compared against historical patterns. Is this payment amount unusual for this executive's approval history? Is the beneficiary a new supplier with no prior relationship? Is the payment destination in a jurisdiction the organization has never sent funds to before? Anomalies don't block the payment automatically but trigger a mandatory secondary review by a different finance team member — creating a "four eyes" check that catches sophisticated social-engineering attempts.
Layer 4: Cooling-Off Period. The highest-risk transactions — six-figure payments, new international beneficiaries, requests received outside business hours — enter a mandatory cooling-off period. The payment is queued but not executed for a configurable window (typically 2-4 hours). During this window, the requesting executive receives a summary of the payment and can cancel it. The cooling-off period defeats urgency-based social engineering, where attackers pressure finance teams to act before anyone questions the request.
The blueprint includes detailed specifications for each layer and integration guides for common ERP and banking systems.