Where Business Information Actually Lives
Business communications — email threads about contracts, Slack messages discussing strategy, video calls reviewing confidential financial information, and team messaging about personnel matters — contain some of the most sensitive and valuable information that organisations hold. They’re also among the least carefully secured: communications tools are selected for ease of use rather than security, authentication standards for communication platforms are often weaker than for business applications, and the volume and velocity of business communication creates attention pressure that makes security shortcuts feel necessary.
The attackers who target business communications are after specific types of information: credentials (to enable account takeover and lateral movement), financial information (to enable fraud), intellectual property (for competitive intelligence or ransomware leverage), and personnel information (for social engineering subsequent attacks). Understanding which communications contain which sensitive information categories — and securing accordingly — is more efficient than applying maximum security uniformly.
Email: The Most Targeted Business Communication Channel
Business email accounts are targeted by attackers in multiple ways: phishing to steal credentials, malware delivery through attachments, business email compromise (BEC) through account takeover or impersonation, and data exfiltration from compromised accounts. The authentication configuration that addresses the largest attack surface is MFA on all business email accounts — email is the recovery mechanism for virtually every other business application, making email account compromise a master-key event that cascades to all connected accounts.
For business email specifically, MFA should be phishing-resistant where possible: hardware security keys or passkeys rather than SMS codes or TOTP apps. Business email compromise attacks that steal TOTP codes in real-time phishing attacks (sophisticated enough to be widely used in 2026) bypass TOTP-based MFA; hardware key authentication doesn’t have this vulnerability. The investment in hardware keys for the accounts with the highest business impact (finance team email, executive email, IT administration email) is proportionate to the risk those accounts represent.
Messaging and Team Collaboration Platforms
Slack, Teams, and similar business messaging platforms have become major repositories of business information — strategy discussions, confidential files shared in channels, and sensitive personnel information shared in direct messages. They’ve also become targets: several significant data breaches have involved Slack workspace data, and threat actors who gain access to a Slack workspace through compromised credentials often find that the conversation history contains more valuable intelligence than the document systems.
Platform-level security for business messaging: MFA on all accounts (Slack and Teams both support SSO/SAML federation with the organisation’s identity provider, which allows enforcing MFA requirements consistently for all users), reviewing and removing app integrations that are no longer used (each integrated app is a potential access path), enabling workspace data retention limits that automatically purge old messages for communication that doesn’t need to be retained, and being deliberate about which channels public-to-workspace rather than limited to specific members.
Video Calls: The Overlooked Security Surface
Video calls have specific security vulnerabilities that go beyond the platform-level authentication concerns: visual information shared during screen sharing (documents open in the background, browser tabs visible, notification content revealed during the call), audio of conversations in the physical space near the call participant, and the specific risk of uninvited attendees in inadequately secured calls (Zoombombing became a cultural touchstone for good reason).
The practical video call security measures: for external calls with clients or partners, require a waiting room and manually admit participants to prevent uninvited attendees; for sensitive internal calls, use a meeting password in addition to the invite link; for calls involving confidential information, brief participants about screen sharing practices before beginning (closing unnecessary applications and browser tabs before sharing, using the ‘share specific application’ option rather than ‘share entire screen’); and conducting sensitive calls from private locations where background conversations aren’t audible.
The Insider Threat Dimension
Business communication security isn’t solely about external attackers: employees, contractors, and former employees with access to communication platforms represent an insider threat that external security controls don’t address. The disgruntled employee who exports customer contact lists from Slack before departing, the contractor who shares confidential documents through personal email to bypass DLP controls, and the former employee whose account remains active after departure are all insider security concerns that intentional access management addresses.
The access management practices that address insider communication security risks: offboarding processes that immediately revoke access to all communication platforms at departure (not after a day or a week), regular access reviews that identify accounts with more access than their current role requires, and data loss prevention (DLP) configuration that flags or prevents specific patterns of data exfiltration (forwarding large volumes of external messages, exporting bulk data, or accessing large amounts of data outside normal patterns). Communication platform DLP is less mature than email DLP for most platforms but is available through Microsoft 365 Purview for Teams and through Slack Enterprise Grid for Slack.
