Galactic’s Incident Response Seminar is November 11th. Free, virtual, and open to all. Register Now

Schedule a Demo

Free Download

Galactic's BEC Incident Response Playbook

A step-by-step guide for handling a business email compromise, whether you're in the middle of one now or want it on hand before you need it.

Preview the Excerpt Download the Playbook
A glass envelope pierced by a phishing hook beside a warning sign

What is business email compromise?

Business email compromise is when an attacker uses a hacked, spoofed, or impersonated email account to get someone to send money, change payment details, or hand over information. The message looks like it came from a coworker, an executive, or a vendor you already trust, so it slips past the tools built to catch malware and lands like any other email. By the time it's caught, a payment may already be out the door.

That's what this playbook is built for: knowing exactly what to do the moment you suspect one.

  • $3.05 billion

    in reported BEC losses in 2025.

    FBI IC3, 2025 Internet Crime Report

  • 24,768

    BEC complaints filed with the FBI in 2025.

    FBI IC3, 2025 Internet Crime Report

  • 31%

    of cyber insurance claims in 2025 came from BEC.

    Coalition, 2025 Cyber Claims Report

Two playbooks

Start with the excerpt. Get the full playbook when you need it.

The excerpt gets you through the first, hardest question: is this real, and how bad is it. The full playbook takes you the rest of the way, through containment, cleanup, and closing the case.

The Excerpt The BEC: Mailbox Takeover Playbook
Length 12 pages 48 pages
Phases Phases 3 and 4 Phases 1 through 11
Best for Working an active incident from the moment you suspect one, or building your response plan ahead of time The complete response, start to finish
What it covers Activation, severity, detection, and triage Everything in the excerpt, plus containment, eradication, recovery, notification, case closure, and post-incident review
Cody Kretsinger, Director of Security Research

The research behind the playbook

This playbook comes from Galactic's security research team, led by Cody Kretsinger. Before he worked in defense, he spent years on the other side, studying how attackers operate inside a compromised account. The team around him brings the same perspective to the rest of the work: building playbooks focused on keeping organizations ready, prepared, and able to respond when something goes wrong. Every step reflects how a mailbox takeover unfolds in practice, and what it takes to shut one down.

Cody Kretsinger
Director of Security Research

Need the whole library?

Galactic's incident response collection runs 49 playbooks across 2,000+ pages, the full response to nearly any incident an organization faces.

Schedule a Demo

Get your copy

Fill out the form and the full 48-page playbook downloads right away. Keep a secure, offline copy so you can run it even if the internet's down mid-incident, and feed it to your LLM to get your team familiar with the material.