The Gatekeepers Nobody Monitors: Executive Assistants and the New Spear-Phishing Economy

When security teams map privileged access, they enumerate domain admins, service accounts, and VPN users. What they almost never enumerate is the executive assistant who can read the CEO's inbox, accept calendar invites on their behalf, and initiate wire transfers after a two-second phone call. That omission is no longer a theoretical gap. Across US enterprises, threat actors have shifted their targeting downward from the executive to the person who manages the executive's digital life.

Why the Assistant Is the Better Target

The logic is straightforward from an attacker's perspective. A CEO's mailbox is monitored, their credentials are vaulted, and their phishing simulations are frequent. An assistant often operates under none of those constraints while holding equivalent access. Delegated mailbox permissions mean a single credential compromise can expose sensitive M&A discussions, board materials, and travel patterns without ever tripping an alert on the principal's account.

Worse, assistants are professionally conditioned to be responsive. Their job is to act quickly on ambiguous requests from busy superiors. Social engineers exploit this directly: a late-Friday email that appears to come from the CFO asking for a discreet payment, framed exactly the way that executive writes, arrives at the one person whose role rewards speed over scrutiny.

Voice Cloning Changes the Verification Math

For years, the standard countermeasure was simple: verify unusual requests by phone. Generative voice tools have eroded that control. A thirty-second sample scraped from a conference keynote, an earnings webcast, or a podcast appearance is enough to produce a convincing clone. Attackers now pair a phishing email with a follow-up call in the executive's own voice, collapsing the trust gap that callback procedures were designed to create.

US companies have already seen the results. There are documented cases of multi-million-dollar wire fraud initiated by cloned-voice calls to finance staff, and the FBI's Internet Crime Complaint Center has repeatedly flagged deepfake-enabled business email compromise as an escalating threat. The pattern is consistent: the call sounds right, the context is right, and the person on the other end has both the authority and the urgency to make verification feel obstructive.

Mapping the Delegation Blind Spot

The first step is visibility. Most organizations cannot produce an accurate inventory of who has delegated access to whom. Ask your identity team to enumerate:

• Full mailbox access and send-on-behalf permissions across executive mailboxes
• Calendar delegation and the ability to accept or modify meeting invites
• Payment initiation and vendor-master-change authority held informally rather than through ERP roles
• Shared credentials to travel, expense, and scheduling platforms

The results are routinely uncomfortable. Delegations granted years ago to departed assistants, standing permissions inherited through mailbox migrations, and off-books credential sharing are common findings. Each is a lateral movement path that bypasses the zero-trust controls you have spent two years building.

A Control Tier Built for Humans

Technical controls matter, but the assistant threat model is fundamentally human, so the remediation must be too.

Tier one: audit and contain. Revoke stale delegations, route payment authority through systems with maker-checker separation, and require phishing-resistant authentication for any account with executive mailbox access. MFA push approvals are not sufficient here—an assistant under pressure will approve anything that ends the interruption.

Tier two: codify verification. Replace the vague instruction to "double-check with me" with a protocol that survives voice cloning. That means a pre-agreed code phrase or callback number for high-risk requests, a hard rule that payment or data-release instructions are never verified through contact details supplied in the request itself, and a no-fault reporting channel so an assistant who catches a suspicious approach is rewarded rather than embarrassed.

Tier three: rehearse. Tabletop exercises almost always include the CISO and the CFO. They almost never include the people who actually manage the executives' calendars. Run scenarios where a cloned voice requests an urgent change to wire instructions, or where a convincing email references a real trip pulled from a compromised calendar. Watch where the process breaks, then fix the process—not the person.

Bringing Gatekeepers Inside the Program

The uncomfortable truth is that executive assistants were excluded from security programs partly because of hierarchy: they are support staff, and security budgets follow org-chart prominence. Threat actors have inverted that calculus. They go where access is broad, monitoring is thin, and social pressure is high.

Treating assistants as privileged users—audited, trained, and included in incident response—costs a fraction of what a single fraudulent wire or leaked board document will. The gatekeepers have always held the keys. It is long past time the security program noticed.