[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fs17gLSNgOMSN7uKgW6Mc16dkIZMwvxfFnk6ehf8ceTg":3},{"article":4,"iocs":43,"watch_terms":51,"solutions":52,"lesson":29},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":32},"700a5adb-c236-4e08-bcaa-4485183684cd","The Behavioral Shift: Why Trusted Relationships Are the Newest Attack Surface","the-behavioral-shift-why-trusted-relationships-are-the-newest-attack-surface-17f4be","New analysis from Abnormal AI reveals how attackers have abandoned technical exploits to weaponize routine workflows and internal trust. The post The Behavioral Shift: Why Trusted Relationships Are the Newest Attack Surface appeared first on SecurityWeek.","Analysis of 800,000 email attacks across 4,600+ organizations reveals attackers are abandoning technical exploits in favor of sophisticated behavioral and social engineering tactics. The study identifies phishing (58%), business email compromise (11%), and vendor email compromise as primary attack vectors, with attackers using redirect chains, link shorteners, and carefully crafted pretexts that blend into legitimate organizational workflows. The trend highlights how trusted relationships and routine processes have become the newest attack surface, with defensive AI recommended as a key countermeasure.","Abnormal AI report shows attackers shift from technical exploits to behavioral targeting via phishing, BEC, and vendor","https:\u002F\u002Fwww.securityweek.com\u002Fthe-behavioral-shift-why-trusted-relationships-are-the-newest-attack-surface\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2026\u002F04\u002FBEC-Email-Chart.jpg","2026-04-23T11:06:44+00:00","2026-04-23T12:00:18.343748+00:00",8,[17,20,23,25],{"name":18,"type":19},"Abnormal AI","vendor",{"name":21,"type":22},"Business Email Compromise (BEC)","technology",{"name":24,"type":22},"Vendor Email Compromise (VEC)",{"name":26,"type":22},"Phishing","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":27,"icon":29,"name":30,"slug":31},null,"Threat Intelligence","threat-intelligence",[33,38],{"category":34},{"id":35,"icon":29,"name":36,"slug":37},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":39},{"id":40,"icon":29,"name":41,"slug":42},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",[44,48],{"type":45,"value":46,"context":47},"domain","tinyurl.com","URL shortener used in 31.6% of phishing redirect chains to obscure malicious final destinations",{"type":45,"value":49,"context":50},"t.co","X\u002FTwitter URL shortener used in 26.6% of phishing redirect chains; automatically applied to outbound links",[18],{"controls":53,"vendors":135},[54,83,109],{"slug":55,"name":56,"problem":57,"products":58},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[59,67,75],{"vendor_slug":60,"vendor_name":61,"vendor_logo":62,"product_slug":63,"product_name":64,"url":65,"description":66},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"slug":84,"name":85,"problem":86,"products":87},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[88,93,101],{"vendor_slug":60,"vendor_name":61,"vendor_logo":62,"product_slug":89,"product_name":90,"url":91,"description":92},"defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.",{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-email-security","Cloudflare Email Security","https:\u002F\u002Fwww.cloudflare.com\u002Fsase\u002Fproducts\u002Femail-security\u002F","Email filtering for phishing and business email compromise.",{"slug":110,"name":111,"problem":112,"products":113},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[114,121,129],{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":110,"product_name":118,"url":119,"description":120},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":130,"product_name":131,"url":133,"description":134},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",[136],{"slug":137,"name":18,"logo_path":138,"roles":139},"abnormal","\u002Fvendor-logos\u002Fabnormal.png",[140],"reported_by"]