VIP Impersonation

VIP Impersonation occurs when a cyber-threat actor impersonates a prominent employee to obtain sensitive data.

By providing Material a list of VIPs as well as any potential known aliases or alternate display names, you'll enhance protections while also limiting false positives.

---

Assign VIPs

You can assign and edit VIP status in two ways, both from the Explorer.

Each VIP Designation has a few fields:

• Email: the account's primary email address
• Aliases: known alternate email addresses (e.g. a personal email) if the VIP frequently uses this to send email to the corporate environment. Separate aliases with a comma then a space: Alias1, Alias2 . Any aliases added are exempted from Material’s VIP Impersonation detections.
• Display name variants: variations of the user's display name, which attacker may attempt to impersonate. Material automatically suggests some that make sense. (E.g. Lee Taylor may be impersonated by an attacker with a display name of Taylor, Lee).

To add or review VIPs, first navigate to Explorer > Accounts.

Suggested VIPs

1. A banner displays on the top with our suggestions. Click Review.

   

   VIP impersonation review banner
2. From the summary, accept or dismiss suggestions. You can also remove suggested aliases and name variants before confirming.

Suggested VIPs review screen

Assign or edit VIP status for a specific account

1. From the accounts page, click an account row to open the Account details view.
2. Click Settings.

   

   Account Detail View
3. Add any known aliases and display name variants.
4. Toggle VIP Impersonation to On, then Save.

Account settings for VIP Impersonation

Which VIPs should you add?

We recommend you add all current and previous executives, co-founders, board members, and potentially members of sensitive groups such as accounts payable.

View all Vips

To view all your existing VIP accounts:

1. Navigate to Explorer > Accounts.
2. Filter to VIP > Include:

Filter accounts to view VIPs