How to Find Your Very Attacked People and Protect Them

When you think of your most at-risk people, your mind probably jumps to the usual suspects: your CEO, CFO, or the head of IT. But here’s the thing: attackers don’t care about your org chart. They care about access. And they’re getting more creative in finding the right people to target. Enter the concept of VAPs: Very Attacked People or Very Attacked Persons. It’s not about titles; it’s about who’s actually being attacked. Sure, your executives are likely targets. But what about that marketing director signing vendor contracts? Or the HR manager handling sensitive employee data? Or the facilities coordinator with building access control privileges? These people might not have “CISO” in their title, but they hold the keys to your kingdom, and attackers know it. The 2025 Verizon Data Breach Investigations Report (DBIR) tells us that 74% of breaches involve the human element, including social engineering, phishing, and errors. The days of indiscriminate phishing blasts are over. Attackers are narrowing their sights on specific individuals. They’re tailoring their tactics. And they’re succeeding.