Securio Offers Targeted Attack Email Training to Counter Increasing Business Email Scams (BEC), Including Tactics to Lure Users to Messaging Apps

LRM Corporation (Headquarters: Kobe City, Hyogo Prefecture, Representative Director: Tetsuya Kōmatsu) is introducing a new training format to its Securio targeted attack email training service that can simulate Business Email Scams (BEC).

This new feature allows for training that prompts only a "reply" without using links or attachments. This enables the simulation of attacks like Business Email Scams (BEC), which are completed solely by replying to the email body.

Furthermore, it is now possible to combine multiple attack formats, such as links, attachments, and QR codes, within a single training email. Additionally, users can now view a flowchart illustrating the progression of a configured training scenario and identify which actions constitute a "defense failure." These enhancements support the operation of training that aligns with real-world threats and the assessment of an organization's security posture.

This security education cloud service, which enables responses to replies only without links or attachments, combined with the integration of multiple formats and visualization of training status, is the first of its kind in Japan (※).

※Based on internal research as of July 2026.

Development Background

Business Email Scams (BEC) are fraudulent schemes where employees are deceived by fake emails impersonating business partners or executives, leading them to transfer funds to the attacker's account or to divulge confidential information or credentials. These attacks often succeed not through links or attachments, but through replies to the email or communication outside of email, making them difficult to detect with technical measures alone. The judgment of each employee becomes the last line of defense.

The damage is severe. According to the U.S. Federal Bureau of Investigation's (FBI) Internet Crime Complaint Center (IC3), BEC scams resulted in approximately $2.77 billion in losses (around 21,000 reported cases) in 2024 alone. In Japan, the National Police Agency reported that losses from fraudulent bank transfers targeting corporations in 2025 reached 4.709 billion yen (approximately a fourfold increase year-on-year), with some companies experiencing losses exceeding 400 million yen.

Sources: FBI/IC3 "2024 Internet Crime Report" April 23, 2025 / National Police Agency "Trends and Other Aspects of Threats in Cyberspace in Reiwa 7 (2025)" March 2026.

However, many common targeted attack email training programs in Japan are primarily designed to measure the opening of links or attachments. In reality, BEC-type attacks, which are completed solely by replying to an email without using links or attachments, have been difficult to simulate in training.

Therefore, we have developed this new feature that allows for the configuration of training focused solely on replies, without the use of links or attachments. This enables the simulation of realistic attacks, such as those that lure recipients to messaging apps or demand replies.

Features of This Function

1) Responding to BEC with "Reply Only" Training Format

Training can now be configured to prompt only a reply to the email, without using links or attachments. This allows for the simulation of Business Email Scams (BEC) that are completed through replies or email-initiated communication. This enhances employees' ability to respond to attacks that are difficult to detect with technical measures alone.

2) Training for More Sophisticated Attacks by Combining Multiple Formats

Multiple attack formats, such as links, attachments, and QR codes, can be combined and set within a single training email. In line with the increasing sophistication of email attacks due to the spread of generative AI, it is possible to conduct more elaborate training with multiple traps.

3) Visualizing Training Flow to Support Accurate Training Configuration

A flowchart allows users to see the progression of a configured training scenario, from receipt and opening to various actions, culminating in a "defense failure." This makes it easier to confirm the implementation status of training settings, facilitating the execution of intended training. This helps to improve training accuracy while appropriately prompting behavioral changes in employees.

Future Outlook

Securio aims to achieve security education that leads to behavioral change in employees by expanding the range of attacks that can be reproduced in training, in line with evolving attack methods. We will continue to enhance training features based on real-world threats and mechanisms for visualizing their outcomes.

※QR Code is a registered trademark of DENSO WAVE INCORPORATED.

About the Security Education Cloud "Securio"

"Securio" is a cloud service that makes security education easy for anyone.

By cycling through multiple functions such as "targeted attack email training" to attract interest in security, "e-learning" to acquire knowledge, and "security awareness" to incorporate it into daily habits, it promotes behavioral change in employees.

Securio Service Site: https://www.lrm.jp/seculio/

About LRM

With the corporate philosophy of "Security Diet®," we provide professional knowledge regarding information security and contribute to the establishment of sustainable information security systems and the improvement of corporate value by promoting behavioral change in people and organizations through increased awareness.

We are actively working every day to become Japan's most accessible information security company, operating the security education cloud service "Securio," which has been adopted by over 2,500 companies, and an information security consulting service with a track record of supporting 580 companies (※) annually for over 19 years. ※ Number of consulting support companies from August 1, 2023, to July 31, 2024.

Company Name: LRM Corporation Headquarters: Yomiuri Kobe Building 5F, 1-2-10 Sakaemachi-dori, Chuo-ku, Kobe City, Hyogo Prefecture Representative: Tetsuya Kōmatsu, Representative Director Established: December 2006 Official Website: https://www.lrm.jp/ Business: Development and provision of the security education cloud "Securio," and information security consulting support.