You’d think by now, with all the coverage phishing gets, people would be better at spotting it. And yet it remains one of the most successful methods attackers use to get into business systems. Not because the people being targeted are naive, but because phishing has got a lot more convincing.
Let’s talk about why it still works, and what actually makes a difference.
It’s not what it used to be
The classic phishing email, the one with the bad grammar, the odd formatting, the Nigerian prince asking for your help, is still out there. But it’s no longer representative of what most businesses are dealing with.
Modern phishing emails are well-written. They use your company name, reference real suppliers, and sometimes even know the name of your IT provider or accountant. They look like invoice reminders, delivery notifications, or password reset requests. If you’re busy and you’re not looking closely, they’re easy to miss.
There’s also a growing category of attacks that go beyond email entirely. Fake Microsoft 365 login pages. Text messages pretending to be from HMRC. Calls from people claiming to be from your bank’s fraud team. The name phishing barely covers it anymore.
Why clever people still get caught
Security training used to focus on teaching people to look for the obvious signs. Check the sender’s email address. Hover over links before clicking. Don’t open unexpected attachments. These are still worth knowing, but they’re not enough on their own.
Attackers have adapted. They use legitimate-looking domains. They host their fake pages on real infrastructure. Some attacks are specifically timed around events like tax season or a known software update, so the message lands when people are half-expecting something similar.
Even experienced people in security roles have been caught out. That’s not a failing. It’s a reflection of how good these attacks have become.
What actually helps
The research on this is clear. Regular, realistic training is more effective than a one-off awareness session. Not a video people watch once a year and forget about. Ongoing simulations, short follow-up content, and a culture where people feel comfortable flagging something suspicious rather than embarrassed they nearly clicked.
We use usecure with our clients for exactly this. It runs simulated phishing campaigns, tracks who interacts with them, and delivers short, targeted training to the people who need it most. Over time, you get a measurable improvement in how your team responds.
The goal isn’t to catch people out or make anyone feel foolish. It’s to build the habit of pausing before clicking, and to make that pause feel natural rather than paranoid.
One more layer worth having
Training reduces risk, but it doesn’t eliminate it. That’s why it works best alongside other measures, things like multi-factor authentication, proper email filtering, and dark web monitoring to catch any credentials that may already be compromised.
If you want to talk through where your business currently stands on this, get in touch. It’s a straightforward conversation and usually throws up a few things worth acting on.
