StrongestLayer Threat Research · Corporate PDA Framework · April 2026

Every attack starts with public information.
Here is what they are looking for.

The Corporate PDA Framework, formally the Corporate Public Data Attack-Surface, maps 24 publicly available information types across 6 categories to the email attacks they enable. This is the reconnaissance layer that precedes every BEC, spear phishing, AiTM, and malware delivery campaign. Not a simulator. A taxonomy of cause and effect: information exposed → attack made possible.
6 information categories
24 data types mapped
3 target levels
5 max-risk combinations
April 2026
Explore the taxonomy → High-risk combinations →
Six Information Categories

What attackers collect before they write a single email

BEC and advanced phishing campaigns follow a consistent reconnaissance sequence. The six categories below represent the intelligence domains an attacker maps before initiating contact. Each category serves a different function in the attack chain — from selecting the right target, to constructing a believable pretext, to timing the attack at the moment of maximum vulnerability.

Cat-A
Organizational Structure
Reporting hierarchies, authorization chains, role responsibilities, approval thresholds. Maps the path from impersonation to authorized financial action.
4 data types · Most useful for: BEC, CEO fraud, payroll diversion
Cat-B
Relationship & Vendor Intelligence
Named vendors, banking relationships, legal counsel, strategic partners. Enables trust exploitation by borrowing from real, pre-existing business relationships.
4 data types · Most useful for: VEC, supply chain pivot, legal impersonation
Cat-C
Financial & Transaction Intelligence
Payment cycles, active deals, transaction volumes, active litigation. Enables timing optimization and amount calibration to match real financial events.
4 data types · Most useful for: CEO fraud, VEC, real estate fraud
Cat-D
Technology & Infrastructure Intelligence
Identity providers, email platforms, security tool stack, SaaS applications. Enables platform-specific credential harvesting and detection evasion.
4 data types · Most useful for: AiTM, credential harvesting, detection evasion
Cat-E
Personnel & Behavioral Intelligence
Executive communication style, employee roles, personal networks, schedule data. Enables individual-level impersonation, deepfake construction, and targeted social engineering.
4 data types · Most useful for: CEO fraud, whaling, deepfake BEC, spear phishing
Cat-F
Event & Trigger Intelligence
Leadership transitions, active M&A, new vendor relationships, earnings windows, breach disclosures. Provides the urgency and pretext that legitimate business events supply for free.
4 data types · Most useful for: All BEC variants, AiTM timing, post-breach SE

Three target levels run across all six categories. Level 1 (Organization) informs target selection and campaign architecture. Level 2 (Operational roles — finance, HR, IT) identifies the actual manipulation targets. Level 3 (Executive / high-value individual) enables impersonation and deepfake construction. The most dangerous attacks require intelligence at all three levels simultaneously.

Full Information Taxonomy

24 data types. Click any to see sources, examples, and attack mappings.

A
Organizational Structure Intelligence
Maps decision architecture and authorization chains. An attacker with this data knows who to impersonate and who to target — without any technical access.
B
Relationship & Vendor Intelligence
Identifies trusted counterparties. Enables attacks that borrow an existing trust relationship rather than building a new one from scratch.
C
Financial & Transaction Intelligence
Reveals when and how much money moves. Enables attacks timed to real financial events — borrowing legitimacy and urgency from the organization's own calendar.
D
Technology & Infrastructure Intelligence
Exposes identity providers, security tools, and platform stack. Binary in its impact: the right platform enables AiTM; the wrong one defeats it before it starts.
E
Personnel & Behavioral Intelligence
Profiles individuals at the level of writing style, schedule, and personal network. Enables conviction-grade impersonation. The category that makes AI-generated attacks genuinely dangerous.
F
Event & Trigger Intelligence
Surfaces organizational events that create legitimate urgency. An attacker with event intelligence borrows urgency from reality instead of manufacturing it — the difference between a suspicious request and an expected one.
Combination Dependency

Single data types rarely enable complete attacks. These combinations do.

The highest-risk configurations arise when an attacker has intelligence across multiple categories simultaneously. Each combination below represents a condition where all prerequisites for a high-conviction, high-value attack are met from publicly available information alone.

CEO Fraud
Critical
A1 org chart + A2 approval threshold + E1 executive voice/style + F1 leadership transition or F2 active M&A

Result: Named impersonation target, named finance target, amount calibrated below verification threshold, urgency borrowed from a real event, writing style cloned from public sources. All CEO fraud prerequisites satisfied.
Vendor Email Compromise
Critical
B1 named vendor relationship + C1 payment cycle timing + F3 new vendor relationship + E2 AP contact identity

Result: Known vendor identity, known payment timing, no established baseline to compare against, right person targeted. The attacker does not need to establish trust — they borrow it from a real relationship at the optimal moment.
AiTM Account Takeover
Critical
D1 identity provider confirmed + B2 banking platform known + E2 operational target identified + F1 new employee or transition window

Result: Correct proxy platform selected, correct credential destination targeted, right person in a period where verification instincts are lowered. MFA becomes irrelevant — the session token is captured, not the password.
Payroll Diversion
High
A2 payroll system access described + E2 HR coordinator identity + C1 payroll cycle timing

Result: Right target, right system context, timed to the week before pay processing when the request is most expected and least scrutinized.
Deepfake-Augmented BEC
Critical
E1 executive audio/video (3+ seconds sufficient for voice clone) + E3 schedule — executive known to be traveling + C2 active deal provides urgency + E2 financial approver identity

Result: Convincing synthetic voice or video, executive unavailable for verification, legitimate financial urgency, right authorization target. Biometric trust is exploited, not circumvented.
Organizational Vulnerability Scoring

Three dimensions. One score. Four risk tiers.

The Corporate PDA vulnerability score measures how much of an attacker's reconnaissance work has already been done by the organization's own public communications. It is not a measure of technical security posture — it is a measure of information exposure that enables social engineering and targeted email attacks.

1
Exposure Breadth
How many data types within each category are publicly available, and how specific and actionable are they? Generic data (industry, approximate headcount) scores low. Named individuals with dollar thresholds and system access descriptions score at maximum weight.
2
Corroboration Density
How many independent sources confirm the same information? Single-source exposure gives an attacker low-confidence intelligence. Three or more independent sources confirming the same data point provides operational certainty and is applied as a 1.6x score multiplier.
3
Combination Coverage
What proportion of the prerequisites for each of the five maximum-risk attack combinations are satisfied? A fully satisfied combination generates a Critical flag regardless of aggregate score — it represents an immediately executable high-value attack chain.
Tier Score Range Operational Meaning
Limited 0 – 25 Insufficient public information for a high-conviction targeted attack. Mass phishing is the primary viable approach. Targeted BEC requires significant additional intelligence investment from the attacker.
Elevated 26 – 50 Sufficient information to construct plausible targeted attacks. One or more combination prerequisites met. A motivated attacker with standard OSINT tooling can build viable campaigns.
High 51 – 75 Multiple combination prerequisites satisfied. High-conviction targeted attacks are executable with minimal additional research. Named individuals at operational and executive levels are identifiable from public sources.
Critical 76 – 100 Maximum-risk combinations fully satisfied. Immediately executable high-value attack chains exist. Deepfake construction and AiTM platform selection are viable from available data. The organization has effectively done the attacker's reconnaissance for them.
StrongestLayer Threat Research · Corporate PDA Framework · April 2026
Companion to the Corporate PDA Model whitepaper.
For detection coverage against attacks enabled by this surface, see the Email Attack Taxonomy (2026).