The Executive Targeting Imperative

Phishing and social engineering attacks targeting senior leadership remain the highest-probability attack vector across Saudi Arabia and the wider GCC. Threat actors recognise that executives hold privileged access, decision-making authority, and often weaker security hygiene than technical staff. A compromised executive account can unlock sensitive financial data, M&A intelligence, customer records subject to the Saudi Personal Data Protection Law (PDPL), and lateral movement into critical systems.

The SAMA Cybersecurity Framework (CSF) and NCA Essential Cyber Controls (ECC) both emphasise executive-level security as a governance requirement. SAMA CSF Governance pillar explicitly mandates awareness and training for leadership roles; NCA ECC Control 3 (User Access Management) and Control 4 (Secure Configuration) require privileged account protection and monitoring—measures that fail without executive participation and understanding.

Attack Patterns Against Leadership

Current phishing campaigns targeting GCC executives typically employ:

  • Spear-phishing with business context: Emails impersonating board members, auditors, or government regulators, referencing real projects, acquisitions, or compliance deadlines to bypass scepticism.
  • Credential harvesting via fake portals: Lookalike login pages for email, banking, or internal HR systems, often hosted on domains registered to appear legitimate.
  • Pretexting via phone and messaging: Attackers posing as IT support, vendors, or employees requesting urgent password resets, wire transfer approvals, or access credentials.
  • Supply-chain and vendor impersonation: Compromised or spoofed vendor communications requesting updated banking details, invoices, or system access—particularly effective in complex procurement environments.
  • QR code and shortened URL obfuscation: Legitimate-looking documents containing malicious QR codes or URL shorteners that mask the true destination, exploiting mobile-first workflows.

Layered Defence Architecture

Technical Controls: Email filtering with machine-learning-based phishing detection, DMARC/SPF/DKIM enforcement, and URL sandboxing should be baseline. Multi-factor authentication (MFA) on all executive accounts—particularly email and privileged access management (PAM) systems—is non-negotiable. SAMA CSF and NCA ECC both require MFA for high-risk accounts; executives qualify. Endpoint Detection and Response (EDR) solutions should monitor executive devices for credential-theft malware and suspicious process execution.

Awareness and Behaviour: Generic security training fails. Executives require role-specific, scenario-based training that reflects their actual workflows: board approvals, vendor negotiations, investor communications. Simulated phishing campaigns—with results reported to the board and tracked over time—demonstrate vulnerability and reinforce learning. Establish clear reporting channels; many executives avoid reporting suspected phishing due to embarrassment, creating blind spots.

Process and Governance: Define verification protocols for high-risk requests: wire transfers above a threshold, system access changes, and data export requests must require out-of-band confirmation (a phone call to a known number, not a reply to email). Designate a trusted security contact for executives to consult before clicking suspicious links or opening unexpected attachments. Document these protocols in the information security policy and ensure board-level endorsement.

PDPL and Regulatory Alignment

Under the Saudi PDPL, organisations must implement appropriate technical and organisational measures to protect personal data. A phishing attack that compromises customer or employee personal data creates regulatory liability. SAMA and NCA guidance reinforces this: data protection and incident response are inseparable from phishing defence. Ensure incident response plans include notification timelines and regulator communication protocols.

Practical Next Steps

Conduct an executive security audit: test MFA coverage, review email filtering logs for near-misses, and assess awareness. Brief the board on phishing risk and the organisation's defence posture. Implement MFA and EDR if not already in place. Launch a targeted awareness programme. Establish a secure reporting channel and measure adoption. Align all controls to SAMA CSF and NCA ECC requirements, and document compliance in your annual security assessment.

Phishing will not disappear. But with executive engagement, layered controls, and regulatory alignment, organisations can significantly reduce the likelihood of a successful breach originating from the C-suite.