Why do even well-trained employees still fall for spear phishing in organisations with strong awareness programmes?

Well-trained employees still fall for spear phishing because the attack exploits trust, urgency, and authority rather than simple ignorance. A believable request from a known executive or colleague can override caution, especially when it references a real project or business pressure. That is why security teams must focus on human behavior and context, not awareness alone.

Why This Matters for Security Teams

spear phishing remains effective because awareness training improves recognition, but it does not eliminate human judgment under pressure. Attackers design messages to look routine, timely, and legitimate, then exploit the gaps between policy and behaviour. That means the real risk is not only credential theft, but also business email compromise, payment diversion, internal fraud, and the use of stolen access to move deeper into systems. Guidance from NIST SP 800-63 Digital Identity Guidelines reinforces that identity assurance depends on more than initial proofing, because trust has to hold up during ongoing use as well.

Security teams often overestimate the value of “click training” and underestimate the operational value of friction, verification, and channel separation. A well-trained employee may still approve a request if it appears to come from a trusted executive, especially during a live incident, quarter-end pressure, or travel disruption. The issue is not ignorance alone. It is the way attackers combine social engineering with context that feels authentic enough to bypass hesitation. In practice, many security teams encounter spear phishing only after an employee has already trusted the request and acted on it before verification could happen.

How It Works in Practice

Modern spear phishing succeeds when the attacker gathers enough contextual detail to make the request feel specific. That can include names, project references, supplier relationships, meeting patterns, or tone matching from publicly available information and prior compromise. The attack often begins outside email as recon, then moves into a message that asks for a credential reset, a document review, a payment approval, or a quick sign-in through a lookalike page. The strongest awareness programmes still help, but they work best when paired with technical controls that reduce reliance on memory under stress.

Good practice is to treat phishing as an identity and trust problem, not only a training problem. That means:

• requiring out-of-band verification for payments, password resets, and mailbox rule changes;
• using phishing-resistant authentication where possible, especially for privileged and finance users;
• restricting the ability to approve risky requests through a single channel;
• logging and alerting on abnormal login patterns, token abuse, and mailbox forwarding changes;
• running simulations that measure response quality, not just click rates.

From a control perspective, organisations should align awareness, identity assurance, and detection. NIST CSF 2.0 is useful here because it frames phishing resilience across governance, protect, detect, and respond functions rather than as a standalone training issue. For the attacker side of the problem, MITRE ATT&CK helps map common social engineering and initial access patterns, while CISA’s guidance on phishing-resistant authentication is especially relevant where account takeover would have high impact. These controls tend to break down when users can still approve urgent exceptions through unofficial channels because the process itself rewards speed over verification.

Common Variations and Edge Cases

Tighter verification often increases friction, requiring organisations to balance user convenience against the risk of high-value compromise. That tradeoff becomes sharper in finance, executive support, procurement, and incident response functions, where delays can affect operations. There is no universal standard for exactly how much friction is appropriate; current guidance suggests calibrating controls to the sensitivity of the request and the privilege of the account rather than applying one rule to every user.

Some spear phishing campaigns do not aim for an immediate credential harvest. Instead, they use relationship-building, message thread hijacking, or compromised supplier accounts to increase credibility over time. Others target mobile devices, collaboration tools, or shared mailboxes where security awareness training is weaker and visual cues are limited. In these cases, standard classroom advice is not enough because the attacker exploits workflow, not just email literacy.

That is why the best outcomes usually come from layered controls: strong identity assurance, resilient authentication, approval segregation, and realistic simulations that reflect the organisation’s actual communication patterns. The lesson is especially important in hybrid and fast-moving environments where employees are expected to make rapid decisions across multiple channels. In those settings, awareness training may reduce risk, but it cannot reliably compensate for weak verification paths or overly trusted internal communication norms.

Related resources from NHI Mgmt Group

• Why do organisations still fall behind even when they have strong vulnerability tooling?
• Why do modern phishing campaigns still succeed even with strong IAM controls?
• Why does phishing remain effective even when employees are trained?
• Why do phished credentials still create major risk in well-trained organisations?