The control breaks when attackers adapt faster than users can reliably recognize and resist them. Phishing simulations can measure awareness, but they do not stop determined attackers, and MFA can still be defeated through tricking the user or abusing weak implementation patterns. If those controls are treated as the main defense, security teams end up with a brittle model that depends on perfect human behavior.
Why the model breaks at the point of user error
Phishing simulations and MFA both assume the defender can keep the human in the loop as the decisive control point. That works poorly once the attacker’s objective is to obtain a session, token, or approval that the user can be tricked into granting. The failure is not that these controls have no value, it is that they do not create durable resistance against social engineering, real-time interception, or repeated prompt abuse.
When these controls are treated as the primary strategy, teams often optimize for awareness scores and enrollment coverage instead of reducing the attacker’s ability to turn a trusted login flow into access. MFA remains important, but it is only one layer in a broader access-control model, especially where attackers can exploit weak recovery paths, legacy factors, or fatigue-based approval pressure. For phish-resistant authentication guidance, see NIST SP 800-63 Digital Identity Guidelines.
The practical consequence is brittleness: security posture becomes highly dependent on whether users notice the lure, resist pressure, and report quickly enough. That may improve measurable behavior, but it does not materially change the attacker’s economics unless the organisation also hardens the actual authentication and session-boundary design.
What attacks still get through when awareness is the main control
Phishing simulations can reveal patterns in user susceptibility, yet they are not a substitute for controls that limit what a captured credential or approved prompt can do. Attackers can still succeed through adversary-in-the-middle interception, MFA fatigue, help-desk social engineering, token theft, or abuse of older authentication paths that remain technically valid. In other words, the control set is evaluating people while the attacker is targeting the login system.
This is why incident patterns often center on the gap between authentication success and actual trustworthiness of the session. A user can “pass” MFA and still hand over access to an attacker who is operating in real time, especially where the organisation has not removed fallback factors, weak recovery, or unphished legacy access paths. Practical identity controls such as phishing-resistant authenticators, session binding, and tighter recovery rules matter more than more simulation volume. Broader identity and access patterns are also covered in Ultimate Guide to NHIs, what are Non-Human Identities, because the same access logic applies wherever a credential can be replayed or abused.
In the same failure mode, the organisation may confuse “users clicked less often” with “attackers can no longer gain access.” Those are not equivalent outcomes. The first is a training signal, the second is a security result.
Practitioner guidance for a control stack that is harder to bypass
What to prioritise: Treat phishing simulations as measurement and awareness tooling, not as a control that meaningfully reduces exposure on its own. The real priority is to reduce the number of ways a stolen login can become a live session, especially through phishing-resistant authentication, stronger recovery, and stricter handling of approval-based flows.
What to verify: Check whether your MFA implementation still allows legacy protocols, weak enrollment paths, phone-based fallback, or help-desk reset routes that an attacker can socially engineer. If any of those paths can mint or restore access without strong proof, the simulation programme may look healthy while the actual control plane remains soft.
- Confirm which accounts can still authenticate through non-phishing-resistant methods.
- Review whether session lifetimes, device trust, and reauthentication thresholds limit replay value.
- Test whether users can be pushed into approving access faster than detection and response can intervene.
Practitioner takeaway: The useful question is not whether users can be trained to spot phishing more often, but whether a successful phish still has a viable path to durable access. If the answer is yes, the defence is incomplete regardless of simulation scores.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST SP 800-63, NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-63 | 4.2 — Phishing-Resistance | Directly addresses authenticators designed to resist phishing and session interception. |
| Recommendation — Prefer phishing-resistant authenticators and limit fallback paths that weaken assurance. | ||
| NIST CSF 2.0 | PR.AA-01 — Identity Management, Authentication, and Access Control | Maps to reducing access risk after a phish succeeds or MFA is bypassed. |
| Recommendation — Harden authentication and access paths so a captured login cannot become durable access. | ||
| CIS Controls v8 | 6.3 — Require MFA for Externally-Exposed Applications | Supports stronger authentication for exposed services where phish-driven compromise is common. |
| Recommendation — Enforce MFA on exposed access points and remove weaker authentication paths. | ||
| OWASP Non-Human Identity Top 10 | NHI-01 — Secret Sprawl and Exposure | Phishing often succeeds by turning exposed secrets or tokens into usable access. |
| Recommendation — Reduce secret exposure and prevent captured credentials from being reused as access. | ||
