Phishing is a social engineering attack where adversaries impersonate trusted entities through email, text messages, phone calls, or fake websites to trick people into revealing sensitive information, clicking malicious links, or transferring money. It remains the most common initial attack vector for data breaches, bypassing technical security controls by targeting human judgment instead.
Phishing is the art of impersonation at scale. Attackers craft messages that appear to come from trusted sources (your bank, your CEO, a SaaS vendor, a shipping company) and trick recipients into taking actions that compromise security: clicking a link to a credential-harvesting site, opening a malware-laden attachment, or wiring money to a fraudulent account.
Phishing comes in several forms:
Phishing doesn't care how good your code is. You can have perfect SAST scans, airtight CSPM configurations, and zero vulnerabilities in your application. One employee clicking a convincing phishing link can bypass all of it.
Here's the landscape:
Phishing defense requires layers because no single control is sufficient:
Phishing is a broad term for social engineering attacks that impersonate trusted entities. Standard phishing campaigns are generic and sent to large numbers of people (like a mass email pretending to be from a shipping company). Spear phishing is a targeted variant where the attacker researches and personalizes the attack for a specific individual or organization, using details like the target's name, job title, current projects, or colleagues' names to make the message more convincing. Spear phishing has a much higher success rate because the personalization makes it harder to identify as fraudulent.
Standard MFA (SMS codes, authenticator apps) significantly reduces phishing risk but isn't immune. Advanced phishing techniques like adversary-in-the-middle (AitM) attacks can intercept MFA codes in real time by proxying the authentication session between the victim and the legitimate service. Phishing-resistant MFA methods, specifically hardware security keys (like YubiKeys) and passkeys, are designed to prevent this because they cryptographically bind authentication to the legitimate domain. If your team handles sensitive data or high-value accounts, phishing-resistant MFA is worth the investment.
First, contain: immediately reset the compromised account's credentials, revoke active sessions, and check for unauthorized access or changes (email forwarding rules, new OAuth app authorizations, unfamiliar devices). Second, investigate: review authentication logs to determine what the attacker accessed, check for lateral movement to other accounts or systems, and assess whether sensitive data was exposed. Third, notify: follow your incident response plan and any applicable breach notification requirements. Finally, learn: use the incident to improve defenses (was MFA enabled? Could email filtering have caught it?) without blaming the employee. Build a culture where reporting phishing attempts quickly is rewarded.
