Skip to content
Layer 8 SecurityThe Human Factor
Standards

The most critical add-on: finance holds the keys to the treasury.

Finance Variant

Attackers do not need to hack the network if they can trick a payroll officer or accounts payable clerk into clicking “Transfer”. Where the Core Baseline keeps attackers out, this variant assumes one is already inside a trusted vendor’s or executive’s mailbox, and relies entirely on verifying the financial process.

Let’s talk
Builds on the Core Baseline. Teams on this variant are trained to Core Baseline domains 1–5 first, then domains 6–9 below.Core Baseline
Specialist domains
4
Topics
10
Domains in total, with the Core Baseline
9

Domain 6

Business Email Compromise (BEC) & Impersonation

The psychological manipulation used to get around standard financial controls, often borrowing the authority of a CEO or a trusted partner.

  1. 6.1

    CEO Fraud (Whaling)

    Recognising forged or highly targeted emails from executives demanding immediate, “highly confidential” transfers for secret acquisitions or overdue accounts.

  2. 6.2

    The “Reply-Chain” Hijack

    How attackers watch a compromised vendor’s inbox for months, then insert themselves into a real, legitimate thread right when an invoice is due.

  3. 6.3

    The Urgency and Secrecy Trap

    Identifying the emotional triggers attackers use to stop finance staff running secondary checks or asking colleagues for approval.

Domain 7

Invoice & Payment Alteration

Where the actual financial loss happens. Training focuses on the mechanics of altered payment routing.

  1. 7.1

    Identifying Tampered Documents

    Spotting small discrepancies in PDF invoices, newly registered lookalike domains (@microsoft.com vs @micros0ft.com) and mismatched routing details.

  2. 7.2

    Mandatory Out-of-Band Verification

    The single most important control in finance. Any request to change bank details is verified on a different channel, such as calling the vendor on a trusted, existing number, never the one in the new email.

  3. 7.3

    Dual Authorisation Avoidance

    Recognising when an attacker is actively trying to get around the company’s multi-person approval process for large transfers.

Domain 8

Internal Fraud & Payroll Scams

Attacks on internal financial processes, aiming for smaller, recurring payouts.

  1. 8.1

    Payroll Diversion

    Identifying fake emails from “employees” asking for their pay to go to a new bank account just before the payroll run.

  2. 8.2

    Gift Card Extortion

    Recognising the common, low-tier scam where an “executive” asks junior finance or admin staff to buy gift cards for a client event.

Domain 9

Financial Incident Response

If a fraudulent transfer goes through, the response window is measured in minutes, not days.

  1. 9.1

    The “Kill Chain” Response

    Knowing exactly who to call internally to freeze accounts before the funds are swept offshore or converted to cryptocurrency.

  2. 9.2

    External Escalation

    The mandatory reporting steps: the sending bank’s fraud team, local police, and the Australian Cyber Security Centre (ACSC) through ReportCyber.

Mapping to compliance

What this module evidences

  • ISO/IEC 27001:2022

    • Annex A 5.8 Information Security in Project Management
    • Annex A 8.3 Information Access Restriction

Other standards

Train your team to the Finance Variant

Tell us which roles you need to cover and what you have to evidence, and we will show you how a session maps to these domains.

Let’s talk