Is Your Cybersecurity Protecting the Right People? A 5-Minute Guide to Your “Very Attacked People”

If your security priorities still revolve around tracking CVSS scores and patching device vulnerabilities, you’re missing the most critical part of the risk equation: people. Attackers don’t follow your org chart; they target anyone who can open a door for them. This is where the concept of “Very Attacked People” (VAP) comes in: they are the individuals in your environment most likely to face persistent, targeted attacks. And spoiler alert: they’re probably not your CEO or CIO.

Attackers Chase Access, Not Job Titles

According to Verizon’s 2025 Data Breach Investigations Report, a staggering 74% of breaches involve the human element—phishing, credential theft, and simple error. The days of generic, scattergun phishing campaigns are over. Today’s attackers are smarter, more targeted, and relentless. While your C-suite is an obvious target, your most vulnerable users are often employees in less visible roles:

• A marketing manager responsible for approving third-party contracts.
• An HR professional with access to the payroll system.
• A facilities supervisor who manages the physical access badge system.

In a traditional risk model, these individuals are rarely flagged as high-value assets, yet they hold the keys to the kingdom: the credentials and access rights that attackers covet.

The Blind Spot of Traditional Risk Models

Most risk models are device-centric. They can tell you a laptop needs patching, but they can’t tell you if its user has been targeted by three separate phishing campaigns this month or flagged by your Endpoint Detection and Response (EDR) tool. By failing to connect alerts to the person behind the keyboard, you risk dismissing a pattern of “low-severity” events that are actually part of a larger, targeted attack. A strange login from a guest account is a minor issue. The same login attempt on your CFO’s account? That’s a potential crisis.

Injecting a Human Dimension into Your Detection Strategy

Your security team is already drowning in alerts. Prioritizing them by technical severity alone creates noise, drives burnout, and allows real threats to slip through. The solution is to shift your focus from how you’re being attacked to who is being attacked. This is how you reclaim control and boost your defense efficiency.

Graylog translates the VAP concept into action with practical, human-centric workflows that allow your team to:

• Unify and correlate attack data from phishing, EDR, anomaly detection, and threat intelligence sources.
• Tag users as VAPs in your SIEM to add critical human context to every alert.
• Automatically prioritize alerts based on user risk, not just event severity.
• Visualize attack trends centered on people to spot repeat targets and emerging campaigns.

This transforms your detection playbook from a reactive checklist into an intelligent, risk-driven strategy.

Focus on VAPs, End Alert Fatigue

Your team doesn’t need more alerts; it needs better context.

By focusing on activity surrounding your most attacked users, Graylog dramatically reduces noise and surfaces the threats that matter. A phishing email sent to a known VAP? That’s an instant high-priority incident. Repeated failed logins on a VAP’s account? That gets flagged before it becomes a breach. A VAP-aware dashboard liberates your team from sifting through raw logs and instead tells a clear story: who is under attack, how, and how often.

Most organizations think they’re protecting their most important people. But if you haven’t identified your VAPs, your defenses have a massive blind spot. Attacker tactics have evolved beyond targeting job titles. It’s time your detection strategy did, too.