Phishing remains the most common way into an organisation because it targets people, not systems.
Attackers use urgency, authority and familiar brands to get a click or a reply. AI tools have made convincing messages cheaper to produce.
Key points
- Most breaches still involve a human step
- Well-written phishing is now the norm
- Layered controls work better than any single fix
How this guide is organised
The guide has 11 chapters. Each one stands on its own, so you can read them in order or go straight to the topic you need.
- The anatomy of a phishing email
- Business email compromise and invoice fraud
- Credential phishing and MFA fatigue attacks
- Email authentication: SPF, DKIM and DMARC
- Filtering, sandboxing and link protection
- Building a reporting culture
- Running phishing simulations that teach
- Payment verification processes for finance teams
- Responding to a reported phish
- Measuring awareness: metrics that matter
Who this guide is for
It is written for IT and security leads, risk and compliance owners and the managers who sign off on the work. This guide covers the attack, the technical controls and the human side.