Skip to main content

Business Email Compromise scenario

Simulate and train employees to recognize a BEC threat.

This article explains how to customize an existing scenario by duplicating it, in order to create a BEC (Business Email Compromise) scenario.

1 - Objectives

This section outlines the goals of customizing a scenario.

  • Simulate and train employees to recognize new threats.

  • Adapt an existing scenario to internal needs.

  • Change the domain to an internal domain to increase its relevance.

  • Create a customized version accessible in the My Scenarios tab.


2 - Prerequisites

3- Definition of BEC

3.1 - A targeted attack based on identity impersonation

Unlike mass phishing: the attacker poses as a trusted person (executive, supplier, lawyer) after researching the targeted organization, often using a compromised account or a spoofed address that appears legitimate.

3.2 - A financial goal or theft of sensitive data

Achieved by manipulating an employee into carrying out a specific action such as a bank transfer, a change of bank details, or the disclosure of confidential information, without a malicious link or infected attachment necessarily being involved.

4 - Customizing the scenario

4.1 - Duplicate a scenario

  1. Browse the scenario library.

  2. Click Duplicate on the thumbnail of the scenario you want to modify.

  3. Duplicating creates a copy that can be edited in the My Scenarios tab.

Interface Arsen – option Duplicate affichée lors du survol d’un scénario dans la bibliothèque.

3.2 - Follow the 4 customization steps

  1. Edit the scenario details

    • Name

    • Language

    • Difficulty level

    • Scenario description

  2. Edit the phishing email
    Adapt the subject line, content, and style.

  3. Edit the landing page (compromise page)
    Adjust the design and compromise logic.

  4. Edit the default training page
    Customize the awareness message shown after compromise.

4 - Changing a scenario's domain to turn it into a BEC scenario

In a Business Email Compromise scenario, the sending domain is an internal domain validated on the platform, in other words, a domain the client normally receives legitimate emails from.

⚠️ Note:
Sending from a real domain that belongs to your organization and is used to run BEC simulations requires an Email API Delivery integration to be enabled.
​
​

4.1 - Add an organization domain to the scenario

After clicking the dropdown list of available domains, two tabs are available:

  • Spoofing domains : These are Arsen's standard attack domains used for phishing campaigns.

  • Organization Domain : These are the company's own domains, used to create a BEC scenario.
    ​

Click the Organization domains tab to add one of the company's domains.


4.2 - Usage recommendations

If you're impersonating a real person, a large-scale campaign using this scenario can generate a large number of replies.

We limit this effect by incorporating an automatic reply-to address pointing to an Arsen spoofing domain.

Organization domains are not currently supported for conversational scenarios


​


​

Related Articles
Did this answer your question?