The phishing problem

Why phishing remains the easiest way into most organisations, and what a realistic defence looks like.

Most organisations have invested heavily in technical security: firewalls, endpoint protection, email filtering. Attackers have responded by going around the technology and straight to people.

Why technology alone isn't enough

• Filters miss well-crafted messages, especially from compromised but legitimate accounts.
• Attackers test their emails against common filters before sending.
• New domains and lookalikes appear faster than blocklists can keep up.

Whatever gets through lands in front of a person, who has to decide in seconds.

Why "just be careful" doesn't work

People are busy, and phishing is designed to arrive at the worst moment. A once-a-year compliance video doesn't build the instinct to pause on an urgent invoice at 5pm on a Friday.

What does work

1. Regular, realistic practice. Short simulations, little and often, matched to real threats.
2. Teach at the moment of the mistake. A short explanation right after a click sticks far better than a lecture months later.
3. Make reporting easy and rewarded, so attacks are caught early.
4. Measure behaviour, not attendance: clicks going down, reports going up.
5. Back it with process, such as out-of-band verification for payments.

That combination of people, practice and process is how PhishFoil approaches the problem.