Keep It Real 2: Phishing Awareness – Still the Weakest Link

Cybersecurity spend keeps rising with better email filtering, stronger detection and more automation promising better protection. Yet phishing still works because while technology can reduce exposure, it can’t remove human judgment.

Phishing has evolved with the obvious, error-filled emails being replaced by messages that look and sound legitimate. Attackers now mimic tone, branding, and context and reference real suppliers, projects, and processes to feel familiar and credible. They also pick their moment by sending their communications during busy periods such as at the end of the day or when key people are unavailable. The aim isn’t just to deceive, it’s to create enough urgency to skip the checks.

Phishing isn’t just an awareness issue; it’s a behavioural risk to which even experienced professionals are vulnerable. People are trained to respond quickly, be helpful and keep work moving and attackers exploit exactly that.

When phishing succeeds the consequences can be immediate: credential theft, unauthorised access, data exposure or fraudulent payments. In professional services it can also compromise client confidentiality and cause regulatory scrutiny and reputational damage. Technology helps but technology alone isn’t enough. The best defence combines awareness with repeatable verification habits.

Do this today:

Pick one verification rule (e.g. “payments always confirmed by phone”) and make it non-negotiable.

Other articles in the 'Keep It Real' series