Phishing Still Works Because We Let It
Despite decades of awareness campaigns, phishing remains the leading initial access vector. The problem is not the technology — it is the training.
Phishing has been around since the early days of email. Security vendors have built entire product categories around detecting it. Billions have been spent on email gateways, sandboxes, and link scanners. And yet, according to every major incident response firm, phishing remains the number one initial access vector year after year.
Why Training Fails
Most security awareness training is compliance-driven, not behaviour-driven. Employees complete an annual module, click through slides, pass a quiz, and return to their inboxes unchanged.
The module taught them what phishing looks like in a sanitised, obvious example. It did not train them to make the split-second judgement call when a convincing email arrives from what appears to be their CEO, timed perfectly to a real business event.
The Human Vulnerability Model
Human attention is finite and context-dependent. An employee who processes hundreds of emails a day will eventually click something they should not. That is not a character flaw — it is a mathematical certainty.
Effective defence accounts for this. It reduces the blast radius of a successful click, rather than assuming the click will never happen.
Key controls:
Simulations Done Right
Phishing simulations work when they are tied to immediate, relevant training. Catching an employee in a simulation and simply logging the failure achieves nothing. Catching them and walking them through exactly why that email looked legitimate — and what to look for — builds genuine pattern recognition.
The goal is not to punish. The goal is to calibrate the human sensor.
The Systemic Fix
Technical controls reduce exposure. Training reduces susceptibility. Reporting culture reduces dwell time.
None of these alone is sufficient. Organisations that rely solely on email filtering are betting everything on perfect detection. Those that invest only in training are ignoring the reality of human fallibility.
The answer is layered defence, where a successful phishing email triggers a response chain, not a catastrophic breach.
Why Most Breaches Are Not Sophisticated
The myth of the elite hacker obscures a more uncomfortable truth: organisations are compromised daily through basic oversights, not zero-days.
Building Security Culture in Small Organisations
Large enterprises have dedicated security teams. Small organisations have to build culture instead. Here is how to make security everyone's responsibility without burning out your team.
Reconnaissance: The Phase Attackers Never Skip
Before any exploit is launched, attackers spend significant time learning about their target. Understanding this phase is essential for building better defences.