Security Adviser Urges Agriculture Leaders to Prepare for Executive Impersonation Attacks
Andrew Rose, an adviser to the bioeconomy cybersecurity nonprofit BIO-ISAC, says fraudsters increasingly impersonate agriculture and life-science executives to steal money or data. He recommends phishing-resistant authentication and a response plan prepared in advance.
Attacks in which criminals pose as company executives are a growing risk for the agriculture sector. Andrew Rose, BioAg adviser to BIO-ISAC, wrote about the issue in a guest article for AgFunderNews. BIO-ISAC is a nonprofit that builds cybersecurity resilience across life sciences, biotech and the wider bioeconomy. The views are the author's own and do not necessarily reflect those of the publication.
Two recent cases
Rose describes a senior agriculture executive whose email account was used in a phishing attack. The message was not sophisticated, but it came from someone highly trusted in the community, and recipients clicked on it. The executive chose not to comment publicly. Incident response firm Invictus Incident Response, prompted by BIO-ISAC, later examined the attack to determine its intent.
In another case, a bioscience leader contacted BIO-ISAC immediately after being alerted that their email account had been taken over. As a result, they regained control, assessed the damage and prepared a response within hours.
The numbers
The US Federal Bureau of Investigation (FBI) calls business email compromise (BEC) one of the most financially damaging online crimes. According to the FBI's 2025 Internet Crime Complaint Center (IC3) report, 24,768 BEC complaints were filed, with reported losses above $3 billion, roughly 10% more than a year earlier. By losses, BEC was the second-largest cybercrime category, behind investment fraud.
Overall, the FBI logged more than 1 million complaints and $20.8 billion in reported losses, up 26%. Of these, 22,364 complaints were AI-related, with $893.3 million in losses.
How to protect against it
Rose notes that attackers use AI tools to compile public information on an executive's partners, payment approvers, vendors, projects and communication style, so a fake email or video can look highly convincing.
His recommendations:
- use multifactor authentication, preferably phishing-resistant methods such as passkeys, as advised by the US cybersecurity agency CISA;
- verify bank account changes, large payments and altered vendor payment details through a second channel, such as a phone call;
- prepare a response plan: stop engaging with the suspicious message, alert IT or security staff right away, secure the account, check for suspicious inbox rules and preserve evidence;
- if money was sent, contact the bank immediately and file an IC3 complaint, which can freeze transactions reported within 72 hours.
