We send invoices and e-signatures via email, is this appropriate, are there other ways, is there a cyber attack risk?

we also send via email, never had an issue but apparently it's not good practice. now we're thinking of setting up an invoicing system

Could you elaborate on that? Security isn't absolute; it's about making attacks not worth the effort.

Correct me if I'm wrong.

I'll try it.

Let me share my experience. Mistakes made on the sending invoice via email side are usually reversible but expensive.

I'm also curious if anyone does it differently.

Let me summarize the topic since several different answers were given. Mistakes made on the sending invoice via email side are usually reversible but expensive.

An automated scan report is not the same as a penetration test.

If you're going this route, sort this out first. If 2FA is on, a stolen password alone is useless.

This is my opinion, I'm not claiming it's absolute truth.

The opposite happened to me, that's why I'm writing. The real issue isn't the number, but what it's based on.

This is my opinion, I'm not claiming it's absolute truth.

youre right, Ive been down that road too. processees without records never improve because you dont know what to fix.

if I were you, I'd go this route.

We've heard this a lot, but it never happened like that for us. If permission and scope aren't in writing, don't start that test.

An automated scan report is not the same as a penetration test. That's all, sorry if I went on too long.

How did you solve this? If you don't write this down from the start, it leads to arguments later.

Proven by experience.

This thread is archived.

This approach has a cost which isn't discussed. When making a decision, first look at what data you have on hand.

Correct me if I'm wrong.

to get into the details: If you dont write this down from the start it leads to arguments later.

good luck with that.

Thanks a lot, I'll try it today.

Following.

Thanks, that was the answer I was looking for.

I didn't know that.

There's a part I don't understand. Most incidents start with a leaked password, not a vulnerability.

Hope this helps.